build(deps): bump actions/github-script from 8 to 9 by dependabot[bot] · Pull Request #25 · from-static/actions

dependabot · 2026-04-11T20:13:17Z

Bumps actions/github-script from 8 to 9.

Release notes

Sourced from actions/github-script's releases.

v9.0.0

New features:

getOctokit factory function — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See Creating additional clients with getOctokit for details and examples.

Orchestration ID in user-agent — The ACTIONS_ORCHESTRATION_ID environment variable is automatically appended to the user-agent string for request tracing.

Breaking changes:

require('@actions/github') no longer works in scripts. The upgrade to @actions/github v9 (ESM-only) means require('@actions/github') will fail at runtime. If you previously used patterns like const { getOctokit } = require('@actions/github') to create secondary clients, use the new injected getOctokit function instead — it's available directly in the script context with no imports needed.

getOctokit is now an injected function parameter. Scripts that declare const getOctokit = ... or let getOctokit = ... will get a SyntaxError because JavaScript does not allow const/let redeclaration of function parameters. Use the injected getOctokit directly, or use var getOctokit = ... if you need to redeclare it.

If your script accesses other @actions/github internals beyond the standard github/octokit client, you may need to update those references for v9 compatibility.

What's Changed

Add ACTIONS_ORCHESTRATION_ID to user-agent string by @Copilot in actions/github-script#695

ci: use deployment: false for integration test environments by @salmanmkc in actions/github-script#712

feat!: add getOctokit to script context, upgrade @actions/github v9, @octokit/core v7, and related packages by @salmanmkc in actions/github-script#700

New Contributors

@Copilot made their first contribution in actions/github-script#695

Full Changelog: actions/github-script@v8.0.0...v9.0.0

Commits

3a2844b Merge pull request #700 from actions/salmanmkc/expose-getoctokit + prepare re...
ca10bbd fix: use @octokit/core/types import for v7 compatibility
86e48e2 merge: incorporate main branch changes
c108472 chore: rebuild dist for v9 upgrade and getOctokit factory
afff112 Merge pull request #712 from actions/salmanmkc/deployment-false + fix user-ag...
ff8117e ci: fix user-agent test to handle orchestration ID
81c6b78 ci: use deployment: false to suppress deployment noise from integration tests
3953caf docs: update README examples from @v8 to @v9, add getOctokit docs and v9 brea...
c17d55b ci: add getOctokit integration test job
a047196 test: add getOctokit integration tests via callAsyncFunction
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [actions/github-script](https://github.com/actions/github-script) from 8 to 9. - [Release notes](https://github.com/actions/github-script/releases) - [Commits](actions/github-script@v8...v9) --- updated-dependencies: - dependency-name: actions/github-script dependency-version: '9' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-04-11T20:15:12Z

Super-linter summary

Language	Validation result
BIOME_FORMAT	Fail ❌
BIOME_LINT	Pass ✅
CHECKOV	Pass ✅
GITHUB_ACTIONS	Fail ❌
GITHUB_ACTIONS_ZIZMOR	Fail ❌
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JAVASCRIPT_ES	Pass ✅
JAVASCRIPT_PRETTIER	Pass ✅
JSCPD	Pass ✅
JSON	Pass ✅
JSON_PRETTIER	Pass ✅
MARKDOWN	Pass ✅
MARKDOWN_PRETTIER	Pass ✅
NATURAL_LANGUAGE	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅
YAML_PRETTIER	Pass ✅

Super-linter detected linting errors

For more information, see the GitHub Actions workflow run

Powered by Super-linter

BIOME_FORMAT

Checked 2 files in 4ms. No fixes applied.
Found 2 errors.package.json format ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  × Formatter would have printed the following content:

    1 1 │   {
    2   │ - ··"devDependencies":·{
    3   │ - ····"standard":·"^17.1.2"
    4   │ - ··}
      2 │ + → "devDependencies":·{
      3 │ + → → "standard":·"^17.1.2"
      4 │ + → }
    5 5 │   }
    6 6 │


scripts/static-utils.js format ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  × Formatter would have printed the following content:

    13 13 │    */
    14 14 │   function parse({ core }, state = {}) {
    15    │ - ··const·fs·=·require("fs");
    16    │ - ··let·config·=·{};
    17    │ - ··try·{
    18    │ - ····config·=·JSON.parse(fs.readFileSync("./static.json",·"utf8"));
    19    │ - ··}·catch·(e)·{
    20    │ - ····core.setFailed(`Unable·to·parse·static.json:·${e.message}`);
    21    │ - ··}
    22    │ - ··//·Merge·GitHub·Action·state·with·the·parsed·static.json
    23    │ - ··config·=·{
    24    │ - ····...config,
    25    │ - ····_static:·{
    26    │ - ······host:·{
    27    │ - ········...state.host,
    28    │ - ······},
    29    │ - ······...config._static,
    30    │ - ····},
    31    │ - ··};
       15 │ + → const·fs·=·require("fs");
       16 │ + → let·config·=·{};
       17 │ + → try·{
       18 │ + → → config·=·JSON.parse(fs.readFileSync("./static.json",·"utf8"));
       19 │ + → }·catch·(e)·{
       20 │ + → → core.setFailed(`Unable·to·parse·static.json:·${e.message}`);
       21 │ + → }
       22 │ + → //·Merge·GitHub·Action·state·with·the·parsed·static.json
       23 │ + → config·=·{
       24 │ + → → ...config,
       25 │ + → → _static:·{
       26 │ + → → → host:·{
       27 │ + → → → → ...state.host,
       28 │ + → → → },
       29 │ + → → → ...config._static,
       30 │ + → → },
       31 │ + → };
    32 32 │
    33    │ - ··try·{
    34    │ - ····validate(config);
    35    │ - ··}·catch·(e)·{
    36    │ - ····core.setFailed(`Invalid·static.json:·${e.message}`);
    37    │ - ··}
    38    │ - ··return·config;
       33 │ + → try·{
       34 │ + → → validate(config);
       35 │ + → }·catch·(e)·{
       36 │ + → → core.setFailed(`Invalid·static.json:·${e.message}`);
       37 │ + → }
       38 │ + → return·config;
    39 39 │   }
    40 40 │
    ····· │
    43 43 │    */
    44 44 │   function validate(config) {
    45    │ - ··if·(!config)·{
    46    │ - ····throw·new·Error("No·configuration·provided.");
    47    │ - ··}
    48    │ - ··if·(!("_static"·in·config)·||·!config._static)·{
    49    │ - ····throw·new·Error("`_static`·member·not·found·in·configuration.");
    50    │ - ··}
    51    │ - ··if·(!config._static?.generator)·{
    52    │ - ····throw·new·Error("A·`generator`·is·required·in·a·`_static`·configuration.");
    53    │ - ··}
    54    │ - ··if·(config._static?.ecosystem·&&·config._static?.ecosystem·!==·"npm")·{
    55    │ - ····throw·new·Error(
    56    │ - ······"Unknown·ecosystem·provided.·`npm`·is·currently·the·only·official·supported·ecosystem.",
    57    │ - ····);
    58    │ - ··}
    59    │ - ··return·true;
       45 │ + → if·(!config)·{
       46 │ + → → throw·new·Error("No·configuration·provided.");
       47 │ + → }
       48 │ + → if·(!("_static"·in·config)·||·!config._static)·{
       49 │ + → → throw·new·Error("`_static`·member·not·found·in·configuration.");
       50 │ + → }
       51 │ + → if·(!config._static?.generator)·{
       52 │ + → → throw·new·Error("A·`generator`·is·required·in·a·`_static`·configuration.");
       53 │ + → }
       54 │ + → if·(config._static?.ecosystem·&&·config._static?.ecosystem·!==·"npm")·{
       55 │ + → → throw·new·Error(
       56 │ + → → → "Unknown·ecosystem·provided.·`npm`·is·currently·the·only·official·supported·ecosystem.",
       57 │ + → → );
       58 │ + → }
       59 │ + → return·true;
    60 60 │   }
    61 61 │
    62 62 │   module.exports = {
    63    │ - ··parse,
    64    │ - ··validate,
       63 │ + → parse,
       64 │ + → validate,
    65 65 │   };
    66 66 │


format ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  × Some errors were emitted while running checks.

GITHUB_ACTIONS

.github/workflows/static.yml:140:9: shellcheck reported issue in this script: SC2086:info:1:36: Double quote to prevent globbing and word splitting [shellcheck]
    |
140 |         run: |
    |         ^~~~
.github/workflows/static.yml:146:9: shellcheck reported issue in this script: SC2086:info:2:12: Double quote to prevent globbing and word splitting [shellcheck]
    |
146 |         run: |
    |         ^~~~

GITHUB_ACTIONS_ZIZMOR

�[1m�[33mwarning[dependabot-cooldown]�[0m�[1m: insufficient cooldown in Dependabot updates�[0m
 �[1m�[94m--> �[0m/github/workspace/.github/dependabot.yml:3:5
  �[1m�[94m|�[0m
�[1m�[94m3�[0m �[1m�[94m|�[0m   - package-ecosystem: "github-actions"
  �[1m�[94m|�[0m     �[1m�[33m^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^�[0m �[1m�[33mmissing cooldown configuration�[0m
  �[1m�[94m|�[0m
  �[1m�[94m= �[0m�[1mnote�[0m: audit confidence → High
  �[1m�[94m= �[0m�[1mnote�[0m: this finding has an auto-fix
  �[1m�[94m= �[0m�[1mhelp�[0m: audit documentation → �[32mhttps://docs.zizmor.sh/audits/#dependabot-cooldown�[39m

�[1m�[33mwarning[dependabot-cooldown]�[0m�[1m: insufficient cooldown in Dependabot updates�[0m
 �[1m�[94m--> �[0m/github/workspace/.github/dependabot.yml:7:5
  �[1m�[94m|�[0m
�[1m�[94m7�[0m �[1m�[94m|�[0m   - package-ecosystem: "npm"
  �[1m�[94m|�[0m     �[1m�[33m^^^^^^^^^^^^^^^^^^^^^^^^�[0m �[1m�[33mmissing cooldown configuration�[0m
  �[1m�[94m|�[0m
  �[1m�[94m= �[0m�[1mnote�[0m: audit confidence → High
  �[1m�[94m= �[0m�[1mnote�[0m: this finding has an auto-fix
  �[1m�[94m= �[0m�[1mhelp�[0m: audit documentation → �[32mhttps://docs.zizmor.sh/audits/#dependabot-cooldown�[39m

�[1m�[91merror[unpinned-uses]�[0m�[1m: unpinned action reference�[0m
  �[1m�[94m--> �[0m/github/workspace/.github/workflows/lint.yml:27:15
   �[1m�[94m|�[0m
�[1m�[94m27�[0m �[1m�[94m|�[0m         uses: actions/checkout@v6
   �[1m�[94m|�[0m               �[1m�[91m^^^^^^^^^^^^^^^^^^^�[0m �[1m�[91maction is not pinned to a hash (required by blanket policy)�[0m
   �[1m�[94m|�[0m
   �[1m�[94m= �[0m�[1mnote�[0m: audit confidence → High
   �[1m�[94m= �[0m�[1mnote�[0m: this finding has an auto-fix
   �[1m�[94m= �[0m�[1mhelp�[0m: audit documentation → �[32mhttps://docs.zizmor.sh/audits/#unpinned-uses�[39m

�[1m�[91merror[unpinned-uses]�[0m�[1m: unpinned action reference�[0m
  �[1m�[94m--> �[0m/github/workspace/.github/workflows/lint.yml:35:15
   �[1m�[94m|�[0m
�[1m�[94m35�[0m �[1m�[94m|�[0m         uses: super-linter/super-linter/slim@v8.5.0
   �[1m�[94m|�[0m               �[1m�[91m^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^�[0m �[1m�[91maction is not pinned to a hash (required by blanket policy)�[0m
   �[1m�[94m|�[0m
   �[1m�[94m= �[0m�[1mnote�[0m: audit confidence → High
   �[1m�[94m= �[0m�[1mnote�[0m: this finding has an auto-fix
   �[1m�[94m= �[0m�[1mhelp�[0m: audit documentation → �[32mhttps://docs.zizmor.sh/audits/#unpinned-uses�[39m

�[1m�[91merror[unpinned-uses]�[0m�[1m: unpinned action reference�[0m
  �[1m�[94m--> �[0m/github/workspace/.github/workflows/static.yml:49:15
   �[1m�[94m|�[0m
�[1m�[94m49�[0m �[1m�[94m|�[0m         uses: actions/checkout@v6
   �[1m�[94m|�[0m               �[1m�[91m^^^^^^^^^^^^^^^^^^^�[0m �[1m�[91maction is not pinned to a hash (required by blanket policy)�[0m
   �[1m�[94m|�[0m
   �[1m�[94m= �[0m�[1mnote�[0m: audit confidence → High
   �[1m�[94m= �[0m�[1mnote�[0m: this finding has an auto-fix
   �[1m�[94m= �[0m�[1mhelp�[0m: audit documentation → �[32mhttps://docs.zizmor.sh/audits/#unpinned-uses�[39m

�[1m�[91merror[unpinned-uses]�[0m�[1m: unpinned action reference�[0m
  �[1m�[94m--> �[0m/github/workspace/.github/workflows/static.yml:55:15
   �[1m�[94m|�[0m
�[1m�[94m55�[0m �[1m�[94m|�[0m         uses: actions/configure-pages@v5
   �[1m�[94m|�[0m               �[1m�[91m^^^^^^^^^^^^^^^^^^^^^^^^^^�[0m �[1m�[91maction is not pinned to a hash (required by blanket policy)�[0m
   �[1m�[94m|�[0m
   �[1m�[94m= �[0m�[1mnote�[0m: audit confidence → High
   �[1m�[94m= �[0m�[1mnote�[0m: this finding has an auto-fix
   �[1m�[94m= �[0m�[1mhelp�[0m: audit documentation → �[32mhttps://docs.zizmor.sh/audits/#unpinned-uses�[39m

�[1m�[91merror[unpinned-uses]�[0m�[1m: unpinned action reference�[0m
  �[1m�[94m--> �[0m/github/workspace/.github/workflows/static.yml:59:15
   �[1m�[94m|�[0m
�[1m�[94m59�[0m �[1m�[94m|�[0m         uses: actions/github-script@v9
   �[1m�[94m|�[0m               �[1m�[91m^^^^^^^^^^^^^^^^^^^^^^^^�[0m �[1m�[91maction is not pinned to a hash (required by blanket policy)�[0m
   �[1m�[94m|�[0m
   �[1m�[94m= �[0m�[1mnote�[0m: audit confidence → High
   �[1m�[94m= �[0m�[1mnote�[0m: this finding has an auto-fix
   �[1m�[94m= �[0m�[1mhelp�[0m: audit documentation → �[32mhttps://docs.zizmor.sh/audits/#unpinned-uses�[39m

�[1m�[91merror[unpinned-uses]�[0m�[1m: unpinned action reference�[0m
   �[1m�[94m--> �[0m/github/workspace/.github/workflows/static.yml:131:15
    �[1m�[94m|�[0m
�[1m�[94m131�[0m �[1m�[94m|�[0m         uses: actions/setup-node@v6
    �[1m�[94m|�[0m               �[1m�[91m^^^^^^^^^^^^^^^^^^^^^�[0m �[1m�[91maction is not pinned to a hash (required by blanket policy)�[0m
    �[1m�[94m|�[0m
    �[1m�[94m= �[0m�[1mnote�[0m: audit confidence → High
    �[1m�[94m= �[0m�[1mnote�[0m: this finding has an auto-fix
    �[1m�[94m= �[0m�[1mhelp�[0m: audit documentation → �[32mhttps://docs.zizmor.sh/audits/#unpinned-uses�[39m

�[1m�[91merror[unpinned-uses]�[0m�[1m: unpinned action reference�[0m
   �[1m�[94m--> �[0m/github/workspace/.github/workflows/static.yml:155:15
    �[1m�[94m|�[0m
�[1m�[94m155�[0m �[1m�[94m|�[0m         uses: actions/checkout@v6
    �[1m�[94m|�[0m               �[1m�[91m^^^^^^^^^^^^^^^^^^^�[0m �[1m�[91maction is not pinned to a hash (required by blanket policy)�[0m
    �[1m�[94m|�[0m
    �[1m�[94m= �[0m�[1mnote�[0m: audit confidence → High
    �[1m�[94m= �[0m�[1mnote�[0m: this finding has an auto-fix
    �[1m�[94m= �[0m�[1mhelp�[0m: audit documentation → �[32mhttps://docs.zizmor.sh/audits/#unpinned-uses�[39m

�[1m�[91merror[unpinned-uses]�[0m�[1m: unpinned action reference�[0m
   �[1m�[94m--> �[0m/github/workspace/.github/workflows/static.yml:187:15
    �[1m�[94m|�[0m
�[1m�[94m187�[0m �[1m�[94m|�[0m         uses: actions/upload-pages-artifact@v4
    �[1m�[94m|�[0m               �[1m�[91m^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^�[0m �[1m�[91maction is not pinned to a hash (required by blanket policy)�[0m
    �[1m�[94m|�[0m
    �[1m�[94m= �[0m�[1mnote�[0m: audit confidence → High
    �[1m�[94m= �[0m�[1mnote�[0m: this finding has an auto-fix
    �[1m�[94m= �[0m�[1mhelp�[0m: audit documentation → �[32mhttps://docs.zizmor.sh/audits/#unpinned-uses�[39m

�[1m�[91merror[unpinned-uses]�[0m�[1m: unpinned action reference�[0m
   �[1m�[94m--> �[0m/github/workspace/.github/workflows/static.yml:193:15
    �[1m�[94m|�[0m
�[1m�[94m193�[0m �[1m�[94m|�[0m         uses: actions/deploy-pages@v4
    �[1m�[94m|�[0m               �[1m�[91m^^^^^^^^^^^^^^^^^^^^^^^�[0m �[1m�[91maction is not pinned to a hash (required by blanket policy)�[0m
    �[1m�[94m|�[0m
    �[1m�[94m= �[0m�[1mnote�[0m: audit confidence → High
    �[1m�[94m= �[0m�[1mnote�[0m: this finding has an auto-fix
    �[1m�[94m= �[0m�[1mhelp�[0m: audit documentation → �[32mhttps://docs.zizmor.sh/audits/#unpinned-uses�[39m

�[32m17�[39m findings (�[1m�[93m6�[39m suppressed, �[92m11�[39m fixable�[0m): �[35m0�[39m informational, �[36m0�[39m low, �[33m2�[39m medium, �[31m9�[39m high🌈 zizmor v1.22.0
�[32m INFO�[0m �[1maudit�[0m�[2m:�[0m �[2mzizmor�[0m�[2m:�[0m 🌈 completed /github/workspace/.github/dependabot.yml
�[32m INFO�[0m �[1maudit�[0m�[2m:�[0m �[2mzizmor�[0m�[2m:�[0m 🌈 completed /github/workspace/.github/workflows/lint.yml
�[32m INFO�[0m �[1maudit�[0m�[2m:�[0m �[2mzizmor�[0m�[2m:�[0m 🌈 completed /github/workspace/.github/workflows/static.yml

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Apr 11, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): bump actions/github-script from 8 to 9#25

build(deps): bump actions/github-script from 8 to 9#25
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/github_actions/actions/github-script-9

dependabot Bot commented on behalf of github Apr 11, 2026

Uh oh!

github-actions Bot commented Apr 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Apr 11, 2026

v9.0.0

What's Changed

New Contributors

Uh oh!

github-actions Bot commented Apr 11, 2026

Super-linter summary

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants