Merge pull request #700 from actions/salmanmkc/expose-getoctokit + prepare release for v9

feat!: add getOctokit to script context, upgrade @actions/github v9, @octokit/core v7, and related packages
fix: use @octokit/core/types import for v7 compatibility
2026-04-30 10:40:10 +00:00 · 2026-04-09 23:39:54 +01:00 · 2026-04-09 22:14:16 +01:00 · 2026-04-09 22:10:00 +01:00 · 2026-04-09 22:02:13 +01:00 · 2026-04-09 21:40:10 +01:00
49 changed files with 34566 additions and 4770 deletions
@@ -3,9 +3,9 @@ description: 'Set up node and install dependencies'
 runs:
  using: 'composite'
  steps:
-    - uses: actions/setup-node@v3
+    - uses: actions/setup-node@v4
      with:
-        node-version: '20.x'
+        node-version: '24.x'
        cache: npm

    - run: npm ci
@@ -5,6 +5,11 @@ updates:
    schedule:
      interval: 'weekly'

+  - package-ecosystem: 'github-actions'
+    directory: '/.github/actions/install-dependencies'
+    schedule:
+      interval: 'weekly'
+
  - package-ecosystem: 'npm'
    directory: '/'
    schedule:
@@ -13,12 +13,15 @@ on:
  pull_request:
  workflow_dispatch:

+permissions:
+  contents: read
+
 jobs:
  check-dist:
    runs-on: ubuntu-latest

    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4

      - uses: ./.github/actions/install-dependencies

@@ -6,11 +6,14 @@ on:
  pull_request:
    branches: [main]

+permissions:
+  contents: read
+
 jobs:
  ci:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
      - uses: ./.github/actions/install-dependencies
      - run: npm run style:check
      - run: npm test
@@ -38,11 +38,11 @@ jobs:

    steps:
    - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v3
      with:
        languages: ${{ matrix.language }}
        # If you wish to specify custom queries, you can do so here or in a config file.
@@ -56,7 +56,7 @@ jobs:
    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
    # If this step fails, then you should remove it and run the build manually (see below)
    - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
+      uses: github/codeql-action/autobuild@v3

    # ℹ️ Command-line programs to run using the OS shell.
    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -69,4 +69,4 @@ jobs:
    #   ./location_of_script_within_repo/buildscript.sh

    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v3
@@ -6,12 +6,15 @@ on:
  pull_request:
    branches: [main]

+permissions:
+  contents: read
+
 jobs:
  test-return:
    name: 'Integration test: return'
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
      - id: output-set
        uses: ./
        with:
@@ -31,7 +34,7 @@ jobs:
    name: 'Integration test: relative-path require'
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
      - id: relative-require
        uses: ./
        with:
@@ -39,7 +42,8 @@ jobs:
          result-encoding: string
      - run: |
          echo "- Validating relative require output"
-          if [[ "${{steps.relative-require.outputs.result}}" != "@actions/github-script" ]]; then
+          expected="@actions/github-script"
+          if [[ "${{steps.relative-require.outputs.result}}" != "$expected" ]]; then
            echo $'::error::\u274C' "Expected '$expected', got ${{steps.relative-require.outputs.result}}"
            exit 1
          fi
@@ -49,7 +53,7 @@ jobs:
    name: 'Integration test: npm package require'
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
      - uses: ./.github/actions/install-dependencies
      - id: npm-require
        uses: ./
@@ -69,7 +73,7 @@ jobs:
    name: 'Integration test: GraphQL previews option'
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
      - uses: ./.github/actions/install-dependencies
      - id: previews-default
        name: Default previews not set
@@ -122,7 +126,7 @@ jobs:
    name: 'Integration test: user-agent option'
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
      - uses: ./.github/actions/install-dependencies
      - id: user-agent-default
        name: Default user-agent not set
@@ -151,22 +155,54 @@ jobs:
            return endpoint({}).headers['user-agent']
          result-encoding: string
      - run: |
+          # User-agent format: <prefix> [actions_orchestration_id/<id>] octokit-core.js/<version> ...
+          # When ACTIONS_ORCHESTRATION_ID is set, the orchestration ID is inserted after the prefix
          echo "- Validating user-agent default"
-          expected="actions/github-script octokit-core.js/"
-          if [[ "${{steps.user-agent-default.outputs.result}}" != "$expected"* ]]; then
-            echo $'::error::\u274C' "Expected user-agent to start with '$expected', got ${{steps.user-agent-default.outputs.result}}"
+          ua="${{steps.user-agent-default.outputs.result}}"
+          if [[ "$ua" != "actions/github-script"* ]] || [[ "$ua" != *"octokit-core.js/"* ]]; then
+            echo $'::error::\u274C' "Expected user-agent to start with 'actions/github-script' and contain 'octokit-core.js/', got $ua"
            exit 1
          fi
          echo "- Validating user-agent set to a value"
-          expected="foobar octokit-core.js/"
-          if [[ "${{steps.user-agent-set.outputs.result}}" != "$expected"* ]]; then
-            echo $'::error::\u274C' "Expected user-agent to start with '$expected', got ${{steps.user-agent-set.outputs.result}}"
+          ua="${{steps.user-agent-set.outputs.result}}"
+          if [[ "$ua" != "foobar"* ]] || [[ "$ua" != *"octokit-core.js/"* ]]; then
+            echo $'::error::\u274C' "Expected user-agent to start with 'foobar' and contain 'octokit-core.js/', got $ua"
            exit 1
          fi
          echo "- Validating user-agent set to an empty string"
-          expected="octokit-core.js/"
-          if [[ "${{steps.user-agent-empty.outputs.result}}" != "$expected"* ]]; then
-            echo $'::error::\u274C' "Expected user-agent to start with '$expected', got ${{steps.user-agent-empty.outputs.result}}"
+          ua="${{steps.user-agent-empty.outputs.result}}"
+          if [[ "$ua" != "actions/github-script"* ]] || [[ "$ua" != *"octokit-core.js/"* ]]; then
+            echo $'::error::\u274C' "Expected user-agent to start with 'actions/github-script' and contain 'octokit-core.js/', got $ua"
+            exit 1
+          fi
+          echo $'\u2705 Test passed' | tee -a $GITHUB_STEP_SUMMARY
+
+  test-get-octokit:
+    name: 'Integration test: getOctokit with token'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/install-dependencies
+      - id: secondary-client
+        name: Create a second client with getOctokit
+        uses: ./
+        env:
+          APP_TOKEN: ${{ github.token }}
+        with:
+          script: |
+            const appOctokit = getOctokit(process.env.APP_TOKEN)
+            const {data} = await appOctokit.rest.repos.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo
+            })
+
+            return `${appOctokit !== github}:${data.full_name}`
+          result-encoding: string
+      - run: |
+          echo "- Validating secondary client output"
+          expected="true:${{ github.repository }}"
+          if [[ "${{steps.secondary-client.outputs.result}}" != "$expected" ]]; then
+            echo $'::error::\u274C' "Expected '$expected', got ${{steps.secondary-client.outputs.result}}"
            exit 1
          fi
          echo $'\u2705 Test passed' | tee -a $GITHUB_STEP_SUMMARY
@@ -175,11 +211,13 @@ jobs:
    strategy:
      matrix:
        environment: ['', 'debug-integration-test']
-    environment: ${{ matrix.environment }}
+    environment:
+      name: ${{ matrix.environment }}
+      deployment: false
    name: "Integration test: debug option (runner.debug mode ${{ matrix.environment && 'enabled' || 'disabled' }})"
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
      - uses: ./.github/actions/install-dependencies
      - id: debug-default
        name: Default debug not set
@@ -253,7 +291,7 @@ jobs:
    name: 'Integration test: base-url option'
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
      - uses: ./.github/actions/install-dependencies

      - id: base-url-default
@@ -8,17 +8,23 @@ on:
    branches:
      - main

+permissions:
+  contents: read
+
 jobs:
  test:
    runs-on: ubuntu-latest
    name: Check licenses
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # prefer to use a full fetch for licensed workflows
-      # https://github.com/jonabc/setup-licensed/releases/tag/v1.1.1
-      - uses: jonabc/setup-licensed@82c5f4d19e8968efa74a25b132922382c2671fe2
+      - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1.229.0
        with:
-          version: '3.x'
+          ruby-version: ruby
+      - uses: github/setup-licensed@v1
+        with:
+          version: '4.x'
+          github_token: ${{ secrets.GITHUB_TOKEN }}
      - uses: ./.github/actions/install-dependencies
      - run: licensed status
@@ -17,4 +17,4 @@ jobs:
        uses: actions/checkout@v4
      - name: Publish
        id: publish
-        uses: actions/publish-immutable-action@0.0.3
+        uses: actions/publish-immutable-action@0.0.4
@@ -5,11 +5,15 @@ on:
    branches: [main]
    types: [opened, synchronize]

+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
  pull-request-test:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
      - uses: ./
        with:
          script: |
@@ -20,9 +24,9 @@ jobs:
              issue_number: context.payload.number,
            })

-            // Find any comment already made by the bot.                                                                                                    
-            const botComment = comments.find(comment => comment.user.id === 41898282)                                                                       
-            const commentBody = "Hello from actions/github-script! (${{ github.sha }})"                  
+            // Find any comment already made by the bot.
+            const botComment = comments.find(comment => comment.user.id === 41898282)
+            const commentBody = "Hello from actions/github-script! (${{ github.sha }})"

            if (context.payload.pull_request.head.repo.full_name !== 'actions/github-script') {
              console.log('Not attempting to write comment on PR from fork');
@@ -1,31 +0,0 @@
-name: Stale Issues & PRs
-
-on:
-  schedule:
-    - cron: '0 0 * * *'
-  workflow_dispatch:
-
-jobs:
-  mark_stale:
-    name: Mark issues and PRs as stale
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/stale@v3
-        with:
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
-          exempt-issue-labels: Not Stale
-          exempt-pr-labels: Not Stale
-          stale-issue-message: >
-            This issue is stale because it has been open for 60 days with no
-            activity. Remove the "Stale" label or comment on the issue, or it
-            will be closed in 7 days.
-          stale-pr-message: >
-            This pull request is stale because it has been open for 60 days
-            with no activity. Remove the "Stale" label or comment on the pull
-            request, or it will be closed in 7 days.
-          close-issue-message: >
-            This issue has been marked as stale and closed due to no activity
-            on it.
-          close-pr-message: >
-            This pull request has been marked as stale and closed due to no
-            activity on it.
@@ -1,2 +1 @@
-/node_modules/
-!/.vscode/
+/node_modules/
@@ -1,6 +1,6 @@
 ---
 name: "@actions/github"
-version: 6.0.0
+version: 9.1.0
 type: npm
 summary: Actions github lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/github
@@ -0,0 +1,32 @@
+---
+name: "@actions/http-client"
+version: 2.2.0
+type: npm
+summary: Actions Http Client
+homepage: https://github.com/actions/toolkit/tree/main/packages/http-client
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    Actions Http Client for Node.js
+
+    Copyright (c) GitHub, Inc.
+
+    All rights reserved.
+
+    MIT License
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
+    associated documentation files (the "Software"), to deal in the Software without restriction,
+    including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense,
+    and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so,
+    subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED *AS IS*, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
+    LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+    NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+    WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+    SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+notices: []
@@ -0,0 +1,32 @@
+---
+name: "@actions/http-client"
+version: 3.0.2
+type: npm
+summary: Actions Http Client
+homepage: https://github.com/actions/toolkit/tree/main/packages/http-client
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    Actions Http Client for Node.js
+
+    Copyright (c) GitHub, Inc.
+
+    All rights reserved.
+
+    MIT License
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
+    associated documentation files (the "Software"), to deal in the Software without restriction,
+    including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense,
+    and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so,
+    subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED *AS IS*, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
+    LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+    NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+    WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+    SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+notices: []
@@ -1,6 +1,6 @@
 ---
 name: "@octokit/auth-token"
-version: 4.0.0
+version: 6.0.0
 type: npm
 summary: GitHub API token authentication for browsers and Node.js
 homepage:
@@ -1,6 +1,6 @@
 ---
 name: "@octokit/core"
-version: 5.0.1
+version: 7.0.6
 type: npm
 summary: Extendable client for GitHub's REST & GraphQL APIs
 homepage:
@@ -1,6 +1,6 @@
 ---
 name: "@octokit/endpoint"
-version: 9.0.0
+version: 11.0.3
 type: npm
 summary: Turns REST API endpoints into generic request options
 homepage:
@@ -1,6 +1,6 @@
 ---
 name: "@octokit/graphql"
-version: 7.0.1
+version: 9.0.3
 type: npm
 summary: GitHub GraphQL API client for browsers and Node
 homepage:
@@ -0,0 +1,20 @@
+---
+name: "@octokit/openapi-types"
+version: 27.0.0
+type: npm
+summary: Generated TypeScript definitions based on GitHub's OpenAPI spec for api.github.com
+homepage:
+license: mit
+licenses:
+- sources: LICENSE
+  text: |-
+    Copyright 2020 Gregor Martynus
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+- sources: README.md
+  text: "[MIT](LICENSE)"
+notices: []
@@ -1,6 +1,6 @@
 ---
 name: "@octokit/plugin-paginate-rest"
-version: 9.0.0
+version: 14.0.0
 type: npm
 summary: Octokit plugin to paginate REST API endpoint responses
 homepage:
@@ -1,6 +1,6 @@
 ---
 name: "@octokit/plugin-request-log"
-version: 4.0.0
+version: 6.0.0
 type: npm
 summary: Log all requests and request errors
 homepage:
@@ -1,6 +1,6 @@
 ---
 name: "@octokit/plugin-rest-endpoint-methods"
-version: 10.0.1
+version: 17.0.0
 type: npm
 summary: Octokit plugin adding one method for all of api.github.com REST API endpoints
 homepage:
@@ -1,6 +1,6 @@
 ---
 name: "@octokit/plugin-retry"
-version: 6.0.1
+version: 8.1.0
 type: npm
 summary: Automatic retry plugin for octokit
 homepage:
@@ -1,6 +1,6 @@
 ---
 name: "@octokit/request-error"
-version: 5.0.0
+version: 7.1.0
 type: npm
 summary: Error class for Octokit request errors
 homepage:
@@ -1,6 +1,6 @@
 ---
 name: "@octokit/request"
-version: 8.1.1
+version: 10.0.8
 type: npm
 summary: Send parameterized requests to GitHub's APIs with sensible defaults in browsers
  and Node
@@ -0,0 +1,20 @@
+---
+name: "@octokit/types"
+version: 16.0.0
+type: npm
+summary: Shared TypeScript definitions for Octokit projects
+homepage:
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    MIT License Copyright (c) 2019 Octokit contributors
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice (including the next paragraph) shall be included in all copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+- sources: README.md
+  text: "[MIT](LICENSE)"
+notices: []
@@ -1,6 +1,6 @@
 ---
 name: "@types/node"
-version: 20.9.0
+version: 24.1.0
 type: npm
 summary: TypeScript definitions for node
 homepage: https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node
@@ -1,6 +1,6 @@
 ---
 name: before-after-hook
-version: 2.2.2
+version: 4.0.0
 type: npm
 summary: asynchronous before/error/after hooks for internal functionality
 homepage: https://github.com/gr2m/before-after-hook#readme
@@ -0,0 +1,32 @@
+---
+name: fast-content-type-parse
+version: 3.0.0
+type: npm
+summary: Parse HTTP Content-Type header according to RFC 7231
+homepage: https://github.com/fastify/fast-content-type-parse#readme
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    MIT License
+
+    Copyright (c) 2023 Fastify
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+notices: []
@@ -0,0 +1,32 @@
+---
+name: json-with-bigint
+version: 3.5.8
+type: npm
+summary: JSON parser/stringifier with BigInt support
+homepage: https://github.com/nickytonline/json-with-bigint#readme
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    MIT License
+
+    Copyright (c) 2023
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+notices: []
@@ -0,0 +1,34 @@
+---
+name: undici
+version: 5.28.5
+type: npm
+summary: An HTTP/1.1 client, written from scratch for Node.js
+homepage: https://undici.nodejs.org
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    MIT License
+
+    Copyright (c) Matteo Collina and Undici contributors
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+- sources: README.md
+  text: MIT
+notices: []
@@ -0,0 +1,34 @@
+---
+name: undici
+version: 6.24.1
+type: npm
+summary: An HTTP/1.1 client, written from scratch for Node.js
+homepage: https://undici.nodejs.org
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    MIT License
+
+    Copyright (c) Matteo Collina and Undici contributors
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+- sources: README.md
+  text: MIT
+notices: []
@@ -1,15 +1,17 @@
 ---
 name: undici-types
-version: 5.26.5
+version: 7.8.0
 type: npm
 summary: A stand-alone types package for Undici
 homepage: https://undici.nodejs.org
 license: mit
 licenses:
- sources: Auto-generated MIT license text
+- sources: LICENSE
  text: |
    MIT License

+    Copyright (c) Matteo Collina and Undici contributors
+
    Permission is hereby granted, free of charge, to any person obtaining a copy
    of this software and associated documentation files (the "Software"), to deal
    in the Software without restriction, including without limitation the rights
@@ -1,6 +1,6 @@
 ---
 name: universal-user-agent
-version: 6.0.0
+version: 7.0.3
 type: npm
 summary: Get a user agent string in both browser and node
 homepage: https://github.com/gr2m/universal-user-agent#readme
@@ -1,10 +0,0 @@
-{
-  "editor.formatOnSave": true,
-  "editor.codeActionsOnSave": {
-    "source.organizeImports": true
-  },
-  "files.exclude": {
-    "**/dist": true,
-    "**/node_modules": true
-  }
-}
@@ -7,6 +7,26 @@
 This action makes it easy to quickly write a script in your workflow that
 uses the GitHub API and the workflow run context.

+### Note
+
+Thank you for your interest in this GitHub action, however, right now we are not taking contributions.
+
+We continue to focus our resources on strategic areas that help our customers be successful while making developers' lives easier. While GitHub Actions remains a key part of this vision, we are allocating resources towards other areas of Actions and are not taking contributions to this repository at this time. The GitHub public roadmap is the best place to follow along for any updates on features we’re working on and what stage they’re in.
+
+We are taking the following steps to better direct requests related to GitHub Actions, including:
+
+1. We will be directing questions and support requests to our [Community Discussions area](https://github.com/orgs/community/discussions/categories/actions)
+
+2. High Priority bugs can be reported through Community Discussions or you can report these to our support team https://support.github.com/contact/bug-report.
+
+3. Security Issues should be handled as per our [security.md](security.md)
+
+We will still provide security updates for this project and fix major breaking changes during this time.
+
+You are welcome to still raise bugs in this repo.
+
+### This action
+
 To use this action, provide an input named `script` that contains the body of an asynchronous JavaScript function call.
 The following arguments will be provided:

@@ -18,6 +38,7 @@ The following arguments will be provided:
 - `glob` A reference to the [@actions/glob](https://github.com/actions/toolkit/tree/main/packages/glob) package
 - `io` A reference to the [@actions/io](https://github.com/actions/toolkit/tree/main/packages/io) package
 - `exec` A reference to the [@actions/exec](https://github.com/actions/toolkit/tree/main/packages/exec) package
+- `getOctokit` A factory function to create additional authenticated Octokit clients with different tokens (see [Creating additional clients](#creating-additional-clients-with-getoctokit))
 - `require` A proxy wrapper around the normal Node.js `require` to enable
  requiring relative paths (relative to the current working directory) and
  requiring npm packages installed in the current working directory. If for
@@ -33,6 +54,29 @@ documentation.

 ## Breaking Changes

+### V9
+
+Version 9 of this action upgrades to `@actions/github` v9, which brings the latest Octokit types and features.
+
+**New features:**
+
+- **`getOctokit` factory function** — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See [Creating additional clients with `getOctokit`](#creating-additional-clients-with-getoctokit) for details and examples.
+- **Orchestration ID in user-agent** — The `ACTIONS_ORCHESTRATION_ID` environment variable is automatically appended to the user-agent string for request tracing.
+
+**Breaking changes:**
+
+- **`require('@actions/github')` no longer works in scripts.** The upgrade to `@actions/github` v9 (ESM-only) means `require('@actions/github')` will fail at runtime. If you previously used patterns like `const { getOctokit } = require('@actions/github')` to create secondary clients, use the new injected `getOctokit` function instead — it's available directly in the script context with no imports needed.
+- `getOctokit` is now an injected function parameter. Scripts that declare `const getOctokit = ...` or `let getOctokit = ...` will get a `SyntaxError` because JavaScript does not allow `const`/`let` redeclaration of function parameters. Use the injected `getOctokit` directly, or use `var getOctokit = ...` if you need to redeclare it.
+- If your script accesses other `@actions/github` internals beyond the standard `github`/`octokit` client, you may need to update those references for v9 compatibility.
+
+### V8
+
+Version 8 of this action updated the runtime to Node 24 - https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runs-for-javascript-actions
+
+All scripts are now run with Node 24 instead of Node 20 and are affected by any breaking changes between Node 20 and 24.
+
+**This requires a minimum Actions Runner version of [v2.327.1](https://github.com/actions/runner/releases/tag/v2.327.1)**
+
 ### V7

 Version 7 of this action updated the runtime to Node 20 - https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runs-for-javascript-actions
@@ -59,13 +103,38 @@ For example, `github.issues.createComment` in V4 becomes `github.rest.issues.cre

 See [development.md](/docs/development.md).

+## Passing inputs to the script
+
+Actions expressions are evaluated before the `script` is passed to the action, so the result of any expressions
+_will be evaluated as JavaScript code_.
+
+It's highly recommended to _not_ evaluate expressions directly in the `script` to avoid
+[script injections](https://docs.github.com/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections)
+and potential `SyntaxError`s when the expression is not valid JavaScript code (particularly when it comes to improperly escaped strings).
+
+To pass inputs, set `env` vars on the action step and reference them in your script with `process.env`:
+
+```yaml
+- uses: actions/github-script@v9
+  env:
+    TITLE: ${{ github.event.pull_request.title }}
+  with:
+    script: |
+      const title = process.env.TITLE;
+      if (title.startsWith('octocat')) {
+        console.log("PR title starts with 'octocat'");
+      } else {
+        console.error("PR title did not start with 'octocat'");
+      }
+```
+
 ## Reading step results

 The return value of the script will be in the step's outputs under the
 "result" key.

 ```yaml
- uses: actions/github-script@v7
+- uses: actions/github-script@v9
  id: set-result
  with:
    script: return "Hello!"
@@ -84,7 +153,7 @@ output of a github-script step. For some workflows, string encoding is preferred
 `result-encoding` input:

 ```yaml
- uses: actions/github-script@v7
+- uses: actions/github-script@v9
  id: my-script
  with:
    result-encoding: string
@@ -96,7 +165,7 @@ output of a github-script step. For some workflows, string encoding is preferred
 By default, requests made with the `github` instance will not be retried. You can configure this with the `retries` option:

 ```yaml
- uses: actions/github-script@v7
+- uses: actions/github-script@v9
  id: my-script
  with:
    result-encoding: string
@@ -114,7 +183,7 @@ In this example, request failures from `github.rest.issues.get()` will be retrie
 You can also configure which status codes should be exempt from retries via the `retry-exempt-status-codes` option:

 ```yaml
- uses: actions/github-script@v7
+- uses: actions/github-script@v9
  id: my-script
  with:
    result-encoding: string
@@ -143,7 +212,7 @@ By default, github-script will use the token provided to your workflow.

 ```yaml
 - name: View context attributes
-  uses: actions/github-script@v7
+  uses: actions/github-script@v9
  with:
    script: console.log(context)
 ```
@@ -159,7 +228,7 @@ jobs:
  comment:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@v9
        with:
          script: |
            github.rest.issues.createComment({
@@ -181,7 +250,7 @@ jobs:
  apply-label:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@v9
        with:
          script: |
            github.rest.issues.addLabels({
@@ -203,7 +272,7 @@ jobs:
  welcome:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@v9
        with:
          script: |
            // Get a list of all issues created by the PR opener
@@ -248,7 +317,7 @@ jobs:
  diff:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@v9
        with:
          script: |
            const diff_url = context.payload.pull_request.diff_url
@@ -272,7 +341,7 @@ jobs:
  list-issues:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@v9
        with:
          script: |
            const query = `query($owner:String!, $name:String!, $label:String!) {
@@ -305,8 +374,8 @@ jobs:
  echo-input:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/github-script@v7
+      - uses: actions/checkout@v4
+      - uses: actions/github-script@v9
        with:
          script: |
            const script = require('./path/to/script.js')
@@ -343,8 +412,8 @@ jobs:
  echo-input:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/github-script@v7
+      - uses: actions/checkout@v4
+      - uses: actions/github-script@v9
        env:
          SHA: '${{env.parentSHA}}'
        with:
@@ -381,14 +450,14 @@ jobs:
  echo-input:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
        with:
          node-version: '20.x'
      - run: npm ci
      # or one-off:
      - run: npm install execa
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@v9
        with:
          script: |
            const execa = require('execa')
@@ -417,8 +486,8 @@ jobs:
  print-stuff:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/github-script@v7
+      - uses: actions/checkout@v4
+      - uses: actions/github-script@v9
        with:
          script: |
            const { default: printStuff } = await import('${{ github.workspace }}/src/print-stuff.js')
@@ -430,40 +499,20 @@ jobs:

 If you want type support for your scripts, you could use the command below to install the
 `@actions/github-script` type declaration.
+
 ```sh
 $ npm i -D @actions/github-script@github:actions/github-script
 ```

 And then add the `jsDoc` declaration to your script like this:
+
 ```js
 // @ts-check
 /** @param {import('@actions/github-script').AsyncFunctionArguments} AsyncFunctionArguments */
-export default async ({ core, context }) => {
-  core.debug("Running something at the moment");
-  return context.actor;
-};
-```
-
-### Use env as input
-
-You can set env vars to use them in your script:
-
-```yaml
-on: push
-
-jobs:
-  echo-input:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/github-script@v7
-        env:
-          FIRST_NAME: Mona
-          LAST_NAME: Octocat
-        with:
-          script: |
-            const { FIRST_NAME, LAST_NAME } = process.env
-
-            console.log(`Hello ${FIRST_NAME} ${LAST_NAME}`)
+export default async ({core, context}) => {
+  core.debug('Running something at the moment')
+  return context.actor
+}
 ```

 ### Using a separate GitHub token
@@ -474,23 +523,129 @@ If you need access to a different repository or an API that the `GITHUB_TOKEN` d

 [Learn more about creating and using encrypted secrets](https://docs.github.com/actions/reference/encrypted-secrets)

+### Creating additional clients with `getOctokit`
+
+The `getOctokit` function is available in the script context and lets you create additional authenticated Octokit clients — useful when you need to interact with the GitHub API using a different token than the one provided to the action (e.g. a GitHub App installation token, a PAT for cross-org access, or a fine-grained token with different permissions).
+
+```js
+getOctokit(token)
+getOctokit(token, opts)
+```
+
+**Parameters:**
+
+| Name    | Type     | Description                                                                             |
+| ------- | -------- | --------------------------------------------------------------------------------------- |
+| `token` | `string` | **Required.** A GitHub token (PAT, GitHub App token, etc.)                              |
+| `opts`  | `object` | Optional. Octokit constructor options (e.g. `userAgent`, `baseUrl`, `request`, `retry`) |
+
+The returned client is fully configured with the same plugins as `github` (retry, request-log, proxy support) — you don't need to set those up yourself.
+
+**Option merging behavior:** `request` and `retry` are deep-merged with the action's defaults, so you can override individual fields (e.g. `{request: {timeout: 5000}}`) without losing the inherited retry count or proxy settings. All other top-level options (like `baseUrl` or `userAgent`) are replaced outright if you provide them.
+
+> **Note:** `getOctokit` is injected as a function parameter (like `github`, `context`, `core`, etc.). You cannot redeclare it with `const` or `let` — this will cause a `SyntaxError`. Use `getOctokit` directly, or use `var` if you need to redeclare it. See [V9 breaking changes](#v9) for details.
+
+#### Basic usage — one primary token, one secondary token
+
 ```yaml
-on:
-  issues:
-    types: [opened]
+- uses: actions/github-script@v9
+  env:
+    APP_TOKEN: ${{ secrets.MY_APP_TOKEN }}
+  with:
+    github-token: ${{ secrets.GITHUB_TOKEN }}
+    script: |
+      // `github` uses GITHUB_TOKEN (scoped to this repo)
+      await github.rest.issues.addLabels({
+        issue_number: context.issue.number,
+        owner: context.repo.owner,
+        repo: context.repo.repo,
+        labels: ['triage']
+      })
+
+      // `getOctokit` creates a second client with a different token
+      const appOctokit = getOctokit(process.env.APP_TOKEN)
+      await appOctokit.rest.repos.createDispatchEvent({
+        owner: 'my-org',
+        repo: 'another-repo',
+        event_type: 'trigger-deploy'
+      })
+```
+
+#### Multiple clients for cross-org workflows
+
+```yaml
+- uses: actions/github-script@v9
+  env:
+    ORG_A_TOKEN: ${{ secrets.ORG_A_PAT }}
+    ORG_B_TOKEN: ${{ secrets.ORG_B_PAT }}
+  with:
+    script: |
+      const orgA = getOctokit(process.env.ORG_A_TOKEN)
+      const orgB = getOctokit(process.env.ORG_B_TOKEN)
+
+      const [repoA, repoB] = await Promise.all([
+        orgA.rest.repos.get({ owner: 'org-a', repo: 'service' }),
+        orgB.rest.repos.get({ owner: 'org-b', repo: 'service' })
+      ])
+
+      console.log(`Org A: ${repoA.data.full_name}`)
+      console.log(`Org B: ${repoB.data.full_name}`)
+```
+
+#### Custom options
+
+```yaml
+- uses: actions/github-script@v9
+  env:
+    GHES_TOKEN: ${{ secrets.GHES_PAT }}
+  with:
+    script: |
+      const ghes = getOctokit(process.env.GHES_TOKEN, {
+        baseUrl: 'https://github.example.com/api/v3'
+      })
+
+      const { data } = await ghes.rest.repos.listForOrg({ org: 'internal' })
+      console.log(`Found ${data.length} repos on GHES`)
+```
+
+### Using exec package
+
+The provided [@actions/exec](https://github.com/actions/toolkit/tree/main/packages/exec) package allows to execute command or tools in a cross platform way:
+
+```yaml
+on: push

 jobs:
-  apply-label:
+  use-exec:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/github-script@v7
+      - uses: actions/checkout@v4
+      - uses: actions/github-script@v9
        with:
-          github-token: ${{ secrets.MY_PAT }}
          script: |
-            github.rest.issues.addLabels({
-              issue_number: context.issue.number,
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              labels: ['Triage']
-            })
+            const exitCode = await exec.exec('echo', ['hello'])
+
+            console.log(exitCode)
+```
+
+`exec` packages provides `getExecOutput` function to retrieve stdout and stderr from executed command:
+
+```yaml
+on: push
+
+jobs:
+  use-get-exec-output:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/github-script@v9
+        with:
+          script: |
+            const {
+              exitCode,
+              stdout,
+              stderr
+            } = await exec.getExecOutput('echo', ['hello']);
+
+            console.log(exitCode, stdout, stderr)
 ```
@@ -8,6 +8,94 @@ describe('callAsyncFunction', () => {
    expect(result).toEqual('bar')
  })

+  test('passes getOctokit through the script context', async () => {
+    const getOctokit = jest.fn().mockReturnValue('secondary-client')
+
+    const result = await callAsyncFunction(
+      {getOctokit} as any,
+      "return getOctokit('token')"
+    )
+
+    expect(getOctokit).toHaveBeenCalledWith('token')
+    expect(result).toEqual('secondary-client')
+  })
+
+  test('getOctokit creates client independent from github', async () => {
+    const github = {rest: {issues: 'primary'}}
+    const getOctokit = jest.fn().mockReturnValue({rest: {issues: 'secondary'}})
+
+    const result = await callAsyncFunction(
+      {github, getOctokit} as any,
+      `
+        const secondary = getOctokit('other-token')
+        return {
+          primary: github.rest.issues,
+          secondary: secondary.rest.issues,
+          different: github !== secondary
+        }
+      `
+    )
+
+    expect(result).toEqual({
+      primary: 'primary',
+      secondary: 'secondary',
+      different: true
+    })
+    expect(getOctokit).toHaveBeenCalledWith('other-token')
+  })
+
+  test('getOctokit passes options through', async () => {
+    const getOctokit = jest.fn().mockReturnValue('client-with-opts')
+
+    const result = await callAsyncFunction(
+      {getOctokit} as any,
+      `return getOctokit('my-token', { baseUrl: 'https://ghes.example.com/api/v3' })`
+    )
+
+    expect(getOctokit).toHaveBeenCalledWith('my-token', {
+      baseUrl: 'https://ghes.example.com/api/v3'
+    })
+    expect(result).toEqual('client-with-opts')
+  })
+
+  test('getOctokit supports plugins', async () => {
+    const getOctokit = jest.fn().mockReturnValue('client-with-plugins')
+
+    const result = await callAsyncFunction(
+      {getOctokit} as any,
+      `return getOctokit('my-token', { previews: ['v3'] }, 'pluginA', 'pluginB')`
+    )
+
+    expect(getOctokit).toHaveBeenCalledWith(
+      'my-token',
+      {previews: ['v3']},
+      'pluginA',
+      'pluginB'
+    )
+    expect(result).toEqual('client-with-plugins')
+  })
+
+  test('multiple getOctokit calls produce independent clients', async () => {
+    const getOctokit = jest
+      .fn()
+      .mockReturnValueOnce({id: 'client-a'})
+      .mockReturnValueOnce({id: 'client-b'})
+
+    const result = await callAsyncFunction(
+      {getOctokit} as any,
+      `
+        const a = getOctokit('token-a')
+        const b = getOctokit('token-b')
+        return { a: a.id, b: b.id, different: a !== b }
+      `
+    )
+
+    expect(getOctokit).toHaveBeenCalledTimes(2)
+    expect(getOctokit).toHaveBeenNthCalledWith(1, 'token-a')
+    expect(getOctokit).toHaveBeenNthCalledWith(2, 'token-b')
+    expect(result).toEqual({a: 'client-a', b: 'client-b', different: true})
+  })
+
  test('throws on ReferenceError', async () => {
    expect.assertions(1)

@@ -25,4 +113,22 @@ describe('callAsyncFunction', () => {
  test('can access console', async () => {
    await callAsyncFunction({} as any, 'console')
  })
+
+  test('injected names are accessible when not redeclared', async () => {
+    const getOctokit = jest.fn().mockReturnValue('from-injected')
+
+    const result = await callAsyncFunction(
+      {getOctokit} as any,
+      `return getOctokit('token')`
+    )
+
+    expect(result).toEqual('from-injected')
+    expect(getOctokit).toHaveBeenCalledWith('token')
+  })
+
+  test('syntax errors in user code still throw', () => {
+    expect(() => callAsyncFunction({} as any, 'const x = {')).toThrow(
+      SyntaxError
+    )
+  })
 })
@@ -0,0 +1,288 @@
+/* eslint-disable @typescript-eslint/no-explicit-any */
+
+import {createConfiguredGetOctokit} from '../src/create-configured-getoctokit'
+
+describe('createConfiguredGetOctokit', () => {
+  const mockRetryPlugin = jest.fn()
+  const mockRequestLogPlugin = jest.fn()
+
+  function makeMockGetOctokit() {
+    return jest.fn().mockReturnValue('mock-client')
+  }
+
+  test('passes token and merged defaults to underlying getOctokit', () => {
+    const raw = makeMockGetOctokit()
+    const defaults = {
+      userAgent: 'actions/github-script actions_orchestration_id/abc',
+      retry: {enabled: true},
+      request: {retries: 3}
+    }
+
+    const wrapped = createConfiguredGetOctokit(
+      raw as any,
+      defaults,
+      mockRetryPlugin,
+      mockRequestLogPlugin
+    )
+    wrapped('my-token' as any)
+
+    expect(raw).toHaveBeenCalledWith(
+      'my-token',
+      expect.objectContaining({
+        userAgent: 'actions/github-script actions_orchestration_id/abc',
+        retry: {enabled: true},
+        request: {retries: 3}
+      }),
+      mockRetryPlugin,
+      mockRequestLogPlugin
+    )
+  })
+
+  test('user options override top-level defaults', () => {
+    const raw = makeMockGetOctokit()
+    const defaults = {
+      userAgent: 'default-agent',
+      previews: ['v3']
+    }
+
+    const wrapped = createConfiguredGetOctokit(raw as any, defaults)
+    wrapped('tok' as any, {userAgent: 'custom-agent'} as any)
+
+    expect(raw).toHaveBeenCalledWith(
+      'tok',
+      expect.objectContaining({userAgent: 'custom-agent', previews: ['v3']})
+    )
+  })
+
+  test('deep-merges request so partial overrides preserve retries', () => {
+    const raw = makeMockGetOctokit()
+    const defaults = {
+      request: {retries: 3, agent: 'proxy-agent', fetch: 'proxy-fetch'}
+    }
+
+    const wrapped = createConfiguredGetOctokit(raw as any, defaults)
+    wrapped('tok' as any, {request: {timeout: 5000}} as any)
+
+    expect(raw).toHaveBeenCalledWith(
+      'tok',
+      expect.objectContaining({
+        request: {
+          retries: 3,
+          agent: 'proxy-agent',
+          fetch: 'proxy-fetch',
+          timeout: 5000
+        }
+      })
+    )
+  })
+
+  test('deep-merges retry so partial overrides preserve existing settings', () => {
+    const raw = makeMockGetOctokit()
+    const defaults = {
+      retry: {enabled: true, retries: 3}
+    }
+
+    const wrapped = createConfiguredGetOctokit(raw as any, defaults)
+    wrapped('tok' as any, {retry: {retries: 5}} as any)
+
+    expect(raw).toHaveBeenCalledWith(
+      'tok',
+      expect.objectContaining({
+        retry: {enabled: true, retries: 5}
+      })
+    )
+  })
+
+  test('user can override request.retries explicitly', () => {
+    const raw = makeMockGetOctokit()
+    const defaults = {request: {retries: 3}}
+
+    const wrapped = createConfiguredGetOctokit(raw as any, defaults)
+    wrapped('tok' as any, {request: {retries: 0}} as any)
+
+    expect(raw).toHaveBeenCalledWith(
+      'tok',
+      expect.objectContaining({request: {retries: 0}})
+    )
+  })
+
+  test('user plugins are appended after default plugins', () => {
+    const raw = makeMockGetOctokit()
+    const customPlugin = jest.fn()
+
+    const wrapped = createConfiguredGetOctokit(
+      raw as any,
+      {},
+      mockRetryPlugin,
+      mockRequestLogPlugin
+    )
+    wrapped('tok' as any, {} as any, customPlugin as any)
+
+    expect(raw).toHaveBeenCalledWith(
+      'tok',
+      expect.any(Object),
+      mockRetryPlugin,
+      mockRequestLogPlugin,
+      customPlugin
+    )
+  })
+
+  test('duplicate plugins are deduplicated', () => {
+    const raw = makeMockGetOctokit()
+
+    const wrapped = createConfiguredGetOctokit(
+      raw as any,
+      {},
+      mockRetryPlugin,
+      mockRequestLogPlugin
+    )
+    // User passes retry again — should not duplicate
+    wrapped('tok' as any, {} as any, mockRetryPlugin as any)
+
+    expect(raw).toHaveBeenCalledWith(
+      'tok',
+      expect.any(Object),
+      mockRetryPlugin,
+      mockRequestLogPlugin
+    )
+  })
+
+  test('applies defaults when no user options provided', () => {
+    const raw = makeMockGetOctokit()
+    const defaults = {
+      userAgent: 'actions/github-script',
+      retry: {enabled: true},
+      request: {retries: 3}
+    }
+
+    const wrapped = createConfiguredGetOctokit(
+      raw as any,
+      defaults,
+      mockRetryPlugin
+    )
+    wrapped('tok' as any)
+
+    expect(raw).toHaveBeenCalledWith(
+      'tok',
+      {
+        userAgent: 'actions/github-script',
+        retry: {enabled: true},
+        request: {retries: 3}
+      },
+      mockRetryPlugin
+    )
+  })
+
+  test('baseUrl: undefined from user does not clobber default', () => {
+    const raw = makeMockGetOctokit()
+    const defaults = {baseUrl: 'https://ghes.example.com/api/v3'}
+
+    const wrapped = createConfiguredGetOctokit(raw as any, defaults)
+    wrapped('tok' as any, {baseUrl: undefined} as any)
+
+    const calledOpts = raw.mock.calls[0][1]
+    expect(calledOpts.baseUrl).toBe('https://ghes.example.com/api/v3')
+  })
+
+  test('undefined values in nested request are stripped', () => {
+    const raw = makeMockGetOctokit()
+    const defaults = {request: {retries: 3, agent: 'proxy'}}
+
+    const wrapped = createConfiguredGetOctokit(raw as any, defaults)
+    wrapped('tok' as any, {request: {retries: undefined, timeout: 5000}} as any)
+
+    const calledOpts = raw.mock.calls[0][1]
+    expect(calledOpts.request).toEqual({
+      retries: 3,
+      agent: 'proxy',
+      timeout: 5000
+    })
+  })
+
+  test('undefined values in nested retry are stripped', () => {
+    const raw = makeMockGetOctokit()
+    const defaults = {retry: {enabled: true, retries: 3}}
+
+    const wrapped = createConfiguredGetOctokit(raw as any, defaults)
+    wrapped('tok' as any, {retry: {enabled: undefined, retries: 5}} as any)
+
+    const calledOpts = raw.mock.calls[0][1]
+    expect(calledOpts.retry).toEqual({enabled: true, retries: 5})
+  })
+
+  test('each call creates an independent client', () => {
+    const raw = jest
+      .fn()
+      .mockReturnValueOnce('client-a')
+      .mockReturnValueOnce('client-b')
+
+    const wrapped = createConfiguredGetOctokit(raw as any, {})
+    const a = wrapped('token-a' as any)
+    const b = wrapped('token-b' as any)
+
+    expect(a).toBe('client-a')
+    expect(b).toBe('client-b')
+    expect(raw).toHaveBeenCalledTimes(2)
+  })
+
+  test('does not mutate defaultOptions between calls', () => {
+    const raw = makeMockGetOctokit()
+    const defaults = {
+      request: {retries: 3},
+      retry: {enabled: true}
+    }
+    const originalDefaults = JSON.parse(JSON.stringify(defaults))
+
+    const wrapped = createConfiguredGetOctokit(raw as any, defaults)
+    wrapped(
+      'tok' as any,
+      {request: {timeout: 5000}, retry: {retries: 10}} as any
+    )
+    wrapped('tok' as any, {request: {timeout: 9000}} as any)
+
+    expect(defaults).toEqual(originalDefaults)
+  })
+
+  test('undefined values in defaults are stripped (e.g. log: undefined)', () => {
+    const raw = makeMockGetOctokit()
+    const defaults = {
+      userAgent: 'actions/github-script',
+      log: undefined,
+      previews: undefined,
+      retry: {enabled: true}
+    }
+
+    const wrapped = createConfiguredGetOctokit(raw as any, defaults)
+    wrapped('tok' as any)
+
+    const calledOpts = raw.mock.calls[0][1]
+    expect(calledOpts.userAgent).toBe('actions/github-script')
+    expect(calledOpts.retry).toEqual({enabled: true})
+    // undefined defaults should be stripped, not passed through
+    expect('log' in calledOpts).toBe(false)
+    expect('previews' in calledOpts).toBe(false)
+  })
+
+  test('falsy-but-valid values are preserved, only undefined is stripped', () => {
+    const raw = makeMockGetOctokit()
+    const defaults = {baseUrl: 'https://ghes.example.com/api/v3'}
+
+    const wrapped = createConfiguredGetOctokit(raw as any, defaults)
+    wrapped(
+      'tok' as any,
+      {
+        log: null,
+        retries: 0,
+        debug: false,
+        userAgent: ''
+      } as any
+    )
+
+    const calledOpts = raw.mock.calls[0][1]
+    expect(calledOpts.log).toBeNull()
+    expect(calledOpts.retries).toBe(0)
+    expect(calledOpts.debug).toBe(false)
+    expect(calledOpts.userAgent).toBe('')
+    expect(calledOpts.baseUrl).toBe('https://ghes.example.com/api/v3')
+  })
+})
@@ -0,0 +1,102 @@
+/* eslint-disable @typescript-eslint/no-explicit-any */
+
+import {callAsyncFunction} from '../src/async-function'
+
+// Create a mock getOctokit that returns Octokit-like objects.
+// Real @actions/github integration is tested in the CI workflow
+// (integration.yml test-get-octokit job). Here we verify the
+// script context wiring — getOctokit is passed through and
+// callable from user scripts.
+function mockGetOctokit(token: string, options?: any) {
+  return {
+    _token: token,
+    _options: options,
+    rest: {
+      issues: {get: async () => ({data: {id: 1}})},
+      pulls: {get: async () => ({data: {id: 2}})}
+    },
+    graphql: async () => ({}),
+    request: async () => ({})
+  }
+}
+
+describe('getOctokit integration via callAsyncFunction', () => {
+  test('getOctokit creates a functional client in script scope', async () => {
+    const result = await callAsyncFunction(
+      {getOctokit: mockGetOctokit} as any,
+      `
+        const client = getOctokit('fake-token-for-test')
+        return {
+          hasRest: typeof client.rest === 'object',
+          hasGraphql: typeof client.graphql === 'function',
+          hasRequest: typeof client.request === 'function',
+          hasIssues: typeof client.rest.issues === 'object',
+          hasPulls: typeof client.rest.pulls === 'object'
+        }
+      `
+    )
+
+    expect(result).toEqual({
+      hasRest: true,
+      hasGraphql: true,
+      hasRequest: true,
+      hasIssues: true,
+      hasPulls: true
+    })
+  })
+
+  test('secondary client is independent from primary github client', async () => {
+    const primary = mockGetOctokit('primary-token')
+
+    const result = await callAsyncFunction(
+      {github: primary, getOctokit: mockGetOctokit} as any,
+      `
+        const secondary = getOctokit('secondary-token')
+        return {
+          bothHaveRest: typeof github.rest === 'object' && typeof secondary.rest === 'object',
+          areDistinct: github !== secondary
+        }
+      `
+    )
+
+    expect(result).toEqual({
+      bothHaveRest: true,
+      areDistinct: true
+    })
+  })
+
+  test('getOctokit accepts options for GHES base URL', async () => {
+    const result = await callAsyncFunction(
+      {getOctokit: mockGetOctokit} as any,
+      `
+        const client = getOctokit('fake-token', {
+          baseUrl: 'https://ghes.example.com/api/v3'
+        })
+        return typeof client.rest === 'object'
+      `
+    )
+
+    expect(result).toBe(true)
+  })
+
+  test('multiple getOctokit calls produce independent clients with different tokens', async () => {
+    const result = await callAsyncFunction(
+      {getOctokit: mockGetOctokit} as any,
+      `
+        const clientA = getOctokit('token-a')
+        const clientB = getOctokit('token-b')
+        return {
+          aHasRest: typeof clientA.rest === 'object',
+          bHasRest: typeof clientB.rest === 'object',
+          areDistinct: clientA !== clientB
+        }
+      `
+    )
+
+    expect(result).toEqual({
+      aHasRest: true,
+      bHasRest: true,
+      areDistinct: true
+    })
+  })
+})
@@ -36,5 +36,5 @@ outputs:
  result:
    description: The return value of the script, stringified with `JSON.stringify`
 runs:
-  using: node20
+  using: node24
  main: dist/index.js
@@ -1,23 +1,23 @@
 {
  "name": "@actions/github-script",
-  "version": "7.0.1",
+  "version": "9.0.0",
  "lockfileVersion": 2,
  "requires": true,
  "packages": {
    "": {
      "name": "@actions/github-script",
-      "version": "7.0.1",
+      "version": "9.0.0",
      "license": "MIT",
      "dependencies": {
        "@actions/core": "^1.10.1",
        "@actions/exec": "^1.1.1",
-        "@actions/github": "^6.0.0",
+        "@actions/github": "^9.0.0",
        "@actions/glob": "^0.4.0",
        "@actions/io": "^1.1.3",
-        "@octokit/core": "^5.0.1",
-        "@octokit/plugin-request-log": "^4.0.0",
-        "@octokit/plugin-retry": "^6.0.1",
-        "@types/node": "^20.9.0"
+        "@octokit/core": "^7.0.0",
+        "@octokit/plugin-request-log": "^6.0.0",
+        "@octokit/plugin-retry": "^8.0.0",
+        "@types/node": "^24.1.0"
      },
      "devDependencies": {
        "@types/jest": "^29.5.5",
@@ -35,7 +35,7 @@
        "typescript": "^5.2.2"
      },
      "engines": {
-        "node": ">=20.0.0 <21.0.0"
+        "node": ">=24"
      }
    },
    "node_modules/@aashutoshrathi/word-wrap": {
@@ -65,14 +65,37 @@
      }
    },
    "node_modules/@actions/github": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/@actions/github/-/github-6.0.0.tgz",
-      "integrity": "sha512-alScpSVnYmjNEXboZjarjukQEzgCRmjMv6Xj47fsdnqGS73bjJNDpiiXmp8jr0UZLdUB6d9jW63IcmddUP+l0g==",
+      "version": "9.1.0",
+      "resolved": "https://registry.npmjs.org/@actions/github/-/github-9.1.0.tgz",
+      "integrity": "sha512-u0hDGQeCS+7VNoLA8hYG65RLdPLMaPGfka0sZ0up7P0AiShqfX6xcuXNteGkQ7X7Tod7AMNwHd4p7DS63i8zzA==",
+      "license": "MIT",
      "dependencies": {
-        "@actions/http-client": "^2.2.0",
-        "@octokit/core": "^5.0.1",
-        "@octokit/plugin-paginate-rest": "^9.0.0",
-        "@octokit/plugin-rest-endpoint-methods": "^10.0.0"
+        "@actions/http-client": "^3.0.2",
+        "@octokit/core": "^7.0.6",
+        "@octokit/plugin-paginate-rest": "^14.0.0",
+        "@octokit/plugin-rest-endpoint-methods": "^17.0.0",
+        "@octokit/request": "^10.0.7",
+        "@octokit/request-error": "^7.1.0",
+        "undici": "^6.23.0"
+      }
+    },
+    "node_modules/@actions/github/node_modules/@actions/http-client": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.2.tgz",
+      "integrity": "sha512-JP38FYYpyqvUsz+Igqlc/JG6YO9PaKuvqjM3iGvaLqFnJ7TFmcLyy2IDrY0bI0qCQug8E9K+elv5ZNfw62ZJzA==",
+      "license": "MIT",
+      "dependencies": {
+        "tunnel": "^0.0.6",
+        "undici": "^6.23.0"
+      }
+    },
+    "node_modules/@actions/github/node_modules/undici": {
+      "version": "6.24.1",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.24.1.tgz",
+      "integrity": "sha512-sC+b0tB1whOCzbtlx20fx3WgCXwkW627p4EA9uM+/tNNPkSS+eSEld6pAs9nDv7WbY1UUljBMYPtu9BCOrCWKA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.17"
      }
    },
    "node_modules/@actions/glob": {
@@ -1268,202 +1291,160 @@
      }
    },
    "node_modules/@octokit/auth-token": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-4.0.0.tgz",
-      "integrity": "sha512-tY/msAuJo6ARbK6SPIxZrPBms3xPbfwBrulZe0Wtr/DIY9lje2HeV1uoebShn6mx7SjCHif6EjMvoREj+gZ+SA==",
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-6.0.0.tgz",
+      "integrity": "sha512-P4YJBPdPSpWTQ1NU4XYdvHvXJJDxM6YwpS0FZHRgP7YFkdVxsWcpWGy/NVqlAA7PcPCnMacXlRm1y2PFZRWL/w==",
+      "license": "MIT",
      "engines": {
-        "node": ">= 18"
+        "node": ">= 20"
      }
    },
    "node_modules/@octokit/core": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/@octokit/core/-/core-5.0.1.tgz",
-      "integrity": "sha512-lyeeeZyESFo+ffI801SaBKmCfsvarO+dgV8/0gD8u1d87clbEdWsP5yC+dSj3zLhb2eIf5SJrn6vDz9AheETHw==",
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/@octokit/core/-/core-7.0.6.tgz",
+      "integrity": "sha512-DhGl4xMVFGVIyMwswXeyzdL4uXD5OGILGX5N8Y+f6W7LhC1Ze2poSNrkF/fedpVDHEEZ+PHFW0vL14I+mm8K3Q==",
+      "license": "MIT",
      "dependencies": {
-        "@octokit/auth-token": "^4.0.0",
-        "@octokit/graphql": "^7.0.0",
-        "@octokit/request": "^8.0.2",
-        "@octokit/request-error": "^5.0.0",
-        "@octokit/types": "^12.0.0",
-        "before-after-hook": "^2.2.0",
-        "universal-user-agent": "^6.0.0"
+        "@octokit/auth-token": "^6.0.0",
+        "@octokit/graphql": "^9.0.3",
+        "@octokit/request": "^10.0.6",
+        "@octokit/request-error": "^7.0.2",
+        "@octokit/types": "^16.0.0",
+        "before-after-hook": "^4.0.0",
+        "universal-user-agent": "^7.0.0"
      },
      "engines": {
-        "node": ">= 18"
+        "node": ">= 20"
      }
    },
    "node_modules/@octokit/endpoint": {
-      "version": "9.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-9.0.0.tgz",
-      "integrity": "sha512-szrQhiqJ88gghWY2Htt8MqUDO6++E/EIXqJ2ZEp5ma3uGS46o7LZAzSLt49myB7rT+Hfw5Y6gO3LmOxGzHijAQ==",
+      "version": "11.0.3",
+      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-11.0.3.tgz",
+      "integrity": "sha512-FWFlNxghg4HrXkD3ifYbS/IdL/mDHjh9QcsNyhQjN8dplUoZbejsdpmuqdA76nxj2xoWPs7p8uX2SNr9rYu0Ag==",
+      "license": "MIT",
      "dependencies": {
-        "@octokit/types": "^11.0.0",
-        "is-plain-object": "^5.0.0",
-        "universal-user-agent": "^6.0.0"
+        "@octokit/types": "^16.0.0",
+        "universal-user-agent": "^7.0.2"
      },
      "engines": {
-        "node": ">= 18"
-      }
-    },
-    "node_modules/@octokit/endpoint/node_modules/@octokit/openapi-types": {
-      "version": "18.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-18.0.0.tgz",
-      "integrity": "sha512-V8GImKs3TeQRxRtXFpG2wl19V7444NIOTDF24AWuIbmNaNYOQMWRbjcGDXV5B+0n887fgDcuMNOmlul+k+oJtw=="
-    },
-    "node_modules/@octokit/endpoint/node_modules/@octokit/types": {
-      "version": "11.1.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-11.1.0.tgz",
-      "integrity": "sha512-Fz0+7GyLm/bHt8fwEqgvRBWwIV1S6wRRyq+V6exRKLVWaKGsuy6H9QFYeBVDV7rK6fO3XwHgQOPxv+cLj2zpXQ==",
-      "dependencies": {
-        "@octokit/openapi-types": "^18.0.0"
+        "node": ">= 20"
      }
    },
    "node_modules/@octokit/graphql": {
-      "version": "7.0.1",
-      "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-7.0.1.tgz",
-      "integrity": "sha512-T5S3oZ1JOE58gom6MIcrgwZXzTaxRnxBso58xhozxHpOqSTgDS6YNeEUvZ/kRvXgPrRz/KHnZhtb7jUMRi9E6w==",
+      "version": "9.0.3",
+      "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-9.0.3.tgz",
+      "integrity": "sha512-grAEuupr/C1rALFnXTv6ZQhFuL1D8G5y8CN04RgrO4FIPMrtm+mcZzFG7dcBm+nq+1ppNixu+Jd78aeJOYxlGA==",
+      "license": "MIT",
      "dependencies": {
-        "@octokit/request": "^8.0.1",
-        "@octokit/types": "^11.0.0",
-        "universal-user-agent": "^6.0.0"
+        "@octokit/request": "^10.0.6",
+        "@octokit/types": "^16.0.0",
+        "universal-user-agent": "^7.0.0"
      },
      "engines": {
-        "node": ">= 18"
-      }
-    },
-    "node_modules/@octokit/graphql/node_modules/@octokit/openapi-types": {
-      "version": "18.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-18.0.0.tgz",
-      "integrity": "sha512-V8GImKs3TeQRxRtXFpG2wl19V7444NIOTDF24AWuIbmNaNYOQMWRbjcGDXV5B+0n887fgDcuMNOmlul+k+oJtw=="
-    },
-    "node_modules/@octokit/graphql/node_modules/@octokit/types": {
-      "version": "11.1.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-11.1.0.tgz",
-      "integrity": "sha512-Fz0+7GyLm/bHt8fwEqgvRBWwIV1S6wRRyq+V6exRKLVWaKGsuy6H9QFYeBVDV7rK6fO3XwHgQOPxv+cLj2zpXQ==",
-      "dependencies": {
-        "@octokit/openapi-types": "^18.0.0"
+        "node": ">= 20"
      }
    },
    "node_modules/@octokit/openapi-types": {
-      "version": "19.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-19.0.0.tgz",
-      "integrity": "sha512-PclQ6JGMTE9iUStpzMkwLCISFn/wDeRjkZFIKALpvJQNBGwDoYYi2fFvuHwssoQ1rXI5mfh6jgTgWuddeUzfWw=="
+      "version": "27.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-27.0.0.tgz",
+      "integrity": "sha512-whrdktVs1h6gtR+09+QsNk2+FO+49j6ga1c55YZudfEG+oKJVvJLQi3zkOm5JjiUXAagWK2tI2kTGKJ2Ys7MGA==",
+      "license": "MIT"
    },
    "node_modules/@octokit/plugin-paginate-rest": {
-      "version": "9.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-9.0.0.tgz",
-      "integrity": "sha512-oIJzCpttmBTlEhBmRvb+b9rlnGpmFgDtZ0bB6nq39qIod6A5DP+7RkVLMOixIgRCYSHDTeayWqmiJ2SZ6xgfdw==",
+      "version": "14.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-14.0.0.tgz",
+      "integrity": "sha512-fNVRE7ufJiAA3XUrha2omTA39M6IXIc6GIZLvlbsm8QOQCYvpq/LkMNGyFlB1d8hTDzsAXa3OKtybdMAYsV/fw==",
+      "license": "MIT",
      "dependencies": {
-        "@octokit/types": "^12.0.0"
+        "@octokit/types": "^16.0.0"
      },
      "engines": {
-        "node": ">= 18"
+        "node": ">= 20"
      },
      "peerDependencies": {
-        "@octokit/core": ">=5"
+        "@octokit/core": ">=6"
      }
    },
    "node_modules/@octokit/plugin-request-log": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-request-log/-/plugin-request-log-4.0.0.tgz",
-      "integrity": "sha512-2uJI1COtYCq8Z4yNSnM231TgH50bRkheQ9+aH8TnZanB6QilOnx8RMD2qsnamSOXtDj0ilxvevf5fGsBhBBzKA==",
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-request-log/-/plugin-request-log-6.0.0.tgz",
+      "integrity": "sha512-UkOzeEN3W91/eBq9sPZNQ7sUBvYCqYbrrD8gTbBuGtHEuycE4/awMXcYvx6sVYo7LypPhmQwwpUe4Yyu4QZN5Q==",
+      "license": "MIT",
      "engines": {
-        "node": ">= 18"
+        "node": ">= 20"
      },
      "peerDependencies": {
-        "@octokit/core": ">=5"
+        "@octokit/core": ">=6"
      }
    },
    "node_modules/@octokit/plugin-rest-endpoint-methods": {
-      "version": "10.0.1",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-10.0.1.tgz",
-      "integrity": "sha512-fgS6HPkPvJiz8CCliewLyym9qAx0RZ/LKh3sATaPfM41y/O2wQ4Z9MrdYeGPVh04wYmHFmWiGlKPC7jWVtZXQA==",
+      "version": "17.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-17.0.0.tgz",
+      "integrity": "sha512-B5yCyIlOJFPqUUeiD0cnBJwWJO8lkJs5d8+ze9QDP6SvfiXSz1BF+91+0MeI1d2yxgOhU/O+CvtiZ9jSkHhFAw==",
+      "license": "MIT",
      "dependencies": {
-        "@octokit/types": "^12.0.0"
+        "@octokit/types": "^16.0.0"
      },
      "engines": {
-        "node": ">= 18"
+        "node": ">= 20"
      },
      "peerDependencies": {
-        "@octokit/core": ">=5"
+        "@octokit/core": ">=6"
      }
    },
    "node_modules/@octokit/plugin-retry": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-retry/-/plugin-retry-6.0.1.tgz",
-      "integrity": "sha512-SKs+Tz9oj0g4p28qkZwl/topGcb0k0qPNX/i7vBKmDsjoeqnVfFUquqrE/O9oJY7+oLzdCtkiWSXLpLjvl6uog==",
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-retry/-/plugin-retry-8.1.0.tgz",
+      "integrity": "sha512-O1FZgXeiGb2sowEr/hYTr6YunGdSAFWnr2fyW39Ah85H8O33ELASQxcvOFF5LE6Tjekcyu2ms4qAzJVhSaJxTw==",
+      "license": "MIT",
      "dependencies": {
-        "@octokit/request-error": "^5.0.0",
-        "@octokit/types": "^12.0.0",
+        "@octokit/request-error": "^7.0.2",
+        "@octokit/types": "^16.0.0",
        "bottleneck": "^2.15.3"
      },
      "engines": {
-        "node": ">= 18"
+        "node": ">= 20"
      },
      "peerDependencies": {
-        "@octokit/core": ">=5"
+        "@octokit/core": ">=7"
      }
    },
    "node_modules/@octokit/request": {
-      "version": "8.1.1",
-      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-8.1.1.tgz",
-      "integrity": "sha512-8N+tdUz4aCqQmXl8FpHYfKG9GelDFd7XGVzyN8rc6WxVlYcfpHECnuRkgquzz+WzvHTK62co5di8gSXnzASZPQ==",
+      "version": "10.0.8",
+      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-10.0.8.tgz",
+      "integrity": "sha512-SJZNwY9pur9Agf7l87ywFi14W+Hd9Jg6Ifivsd33+/bGUQIjNujdFiXII2/qSlN2ybqUHfp5xpekMEjIBTjlSw==",
+      "license": "MIT",
      "dependencies": {
-        "@octokit/endpoint": "^9.0.0",
-        "@octokit/request-error": "^5.0.0",
-        "@octokit/types": "^11.1.0",
-        "is-plain-object": "^5.0.0",
-        "universal-user-agent": "^6.0.0"
+        "@octokit/endpoint": "^11.0.3",
+        "@octokit/request-error": "^7.0.2",
+        "@octokit/types": "^16.0.0",
+        "fast-content-type-parse": "^3.0.0",
+        "json-with-bigint": "^3.5.3",
+        "universal-user-agent": "^7.0.2"
      },
      "engines": {
-        "node": ">= 18"
+        "node": ">= 20"
      }
    },
    "node_modules/@octokit/request-error": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-5.0.0.tgz",
-      "integrity": "sha512-1ue0DH0Lif5iEqT52+Rf/hf0RmGO9NWFjrzmrkArpG9trFfDM/efx00BJHdLGuro4BR/gECxCU2Twf5OKrRFsQ==",
+      "version": "7.1.0",
+      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-7.1.0.tgz",
+      "integrity": "sha512-KMQIfq5sOPpkQYajXHwnhjCC0slzCNScLHs9JafXc4RAJI+9f+jNDlBNaIMTvazOPLgb4BnlhGJOTbnN0wIjPw==",
+      "license": "MIT",
      "dependencies": {
-        "@octokit/types": "^11.0.0",
-        "deprecation": "^2.0.0",
-        "once": "^1.4.0"
+        "@octokit/types": "^16.0.0"
      },
      "engines": {
-        "node": ">= 18"
-      }
-    },
-    "node_modules/@octokit/request-error/node_modules/@octokit/openapi-types": {
-      "version": "18.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-18.0.0.tgz",
-      "integrity": "sha512-V8GImKs3TeQRxRtXFpG2wl19V7444NIOTDF24AWuIbmNaNYOQMWRbjcGDXV5B+0n887fgDcuMNOmlul+k+oJtw=="
-    },
-    "node_modules/@octokit/request-error/node_modules/@octokit/types": {
-      "version": "11.1.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-11.1.0.tgz",
-      "integrity": "sha512-Fz0+7GyLm/bHt8fwEqgvRBWwIV1S6wRRyq+V6exRKLVWaKGsuy6H9QFYeBVDV7rK6fO3XwHgQOPxv+cLj2zpXQ==",
-      "dependencies": {
-        "@octokit/openapi-types": "^18.0.0"
-      }
-    },
-    "node_modules/@octokit/request/node_modules/@octokit/openapi-types": {
-      "version": "18.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-18.0.0.tgz",
-      "integrity": "sha512-V8GImKs3TeQRxRtXFpG2wl19V7444NIOTDF24AWuIbmNaNYOQMWRbjcGDXV5B+0n887fgDcuMNOmlul+k+oJtw=="
-    },
-    "node_modules/@octokit/request/node_modules/@octokit/types": {
-      "version": "11.1.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-11.1.0.tgz",
-      "integrity": "sha512-Fz0+7GyLm/bHt8fwEqgvRBWwIV1S6wRRyq+V6exRKLVWaKGsuy6H9QFYeBVDV7rK6fO3XwHgQOPxv+cLj2zpXQ==",
-      "dependencies": {
-        "@octokit/openapi-types": "^18.0.0"
+        "node": ">= 20"
      }
    },
    "node_modules/@octokit/types": {
-      "version": "12.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-12.0.0.tgz",
-      "integrity": "sha512-EzD434aHTFifGudYAygnFlS1Tl6KhbTynEWELQXIbTY8Msvb5nEqTZIm7sbPEt4mQYLZwu3zPKVdeIrw0g7ovg==",
+      "version": "16.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-16.0.0.tgz",
+      "integrity": "sha512-sKq+9r1Mm4efXW1FCk7hFSeJo4QKreL/tTbR0rz/qx/r1Oa2VV83LTA/H/MuCOX7uCIJmQVRKBcbmWoySjAnSg==",
+      "license": "MIT",
      "dependencies": {
-        "@octokit/openapi-types": "^19.0.0"
+        "@octokit/openapi-types": "^27.0.0"
      }
    },
    "node_modules/@pkgr/utils": {
@@ -1672,11 +1653,12 @@
      "dev": true
    },
    "node_modules/@types/node": {
-      "version": "20.9.0",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-20.9.0.tgz",
-      "integrity": "sha512-nekiGu2NDb1BcVofVcEKMIwzlx4NjHlcjhoxxKBNLtz15Y1z7MYf549DFvkHSId02Ax6kGwWntIBPC3l/JZcmw==",
+      "version": "24.1.0",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.1.0.tgz",
+      "integrity": "sha512-ut5FthK5moxFKH2T1CUOC6ctR67rQRvvHdFLCD2Ql6KXmMuCrjsSsRI9UsLCm9M18BMwClv4pn327UvB7eeO1w==",
+      "license": "MIT",
      "dependencies": {
-        "undici-types": "~5.26.4"
+        "undici-types": "~7.8.0"
      }
    },
    "node_modules/@types/semver": {
@@ -2241,9 +2223,10 @@
      "integrity": "sha1-ibTRmasr7kneFk6gK4nORi1xt2c="
    },
    "node_modules/before-after-hook": {
-      "version": "2.2.2",
-      "resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-2.2.2.tgz",
-      "integrity": "sha512-3pZEU3NT5BFUo/AD5ERPWOgQOCZITni6iavr5AUw5AUwQjMlI0kzu5btnyD39AF0gUEsDPwJT+oY1ORBJijPjQ=="
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-4.0.0.tgz",
+      "integrity": "sha512-q6tR3RPqIB1pMiTRMFcZwuG5T8vwp+vUvEG0vuI6B+Rikh5BfPp2fQ82c925FOs+b0lcFQ8CFrL+KbilfZFhOQ==",
+      "license": "Apache-2.0"
    },
    "node_modules/big-integer": {
      "version": "1.6.51",
@@ -2913,11 +2896,6 @@
        "url": "https://github.com/sponsors/ljharb"
      }
    },
-    "node_modules/deprecation": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/deprecation/-/deprecation-2.3.1.tgz",
-      "integrity": "sha512-xmHIy4F3scKVwMsQ4WnVaS8bHOx0DmVwRywosKhaILI0ywMDWPtBSku2HNxRvF7jtwDRsoEwYQSfbxj8b7RlJQ=="
-    },
    "node_modules/detect-newline": {
      "version": "3.1.0",
      "resolved": "https://registry.npmjs.org/detect-newline/-/detect-newline-3.1.0.tgz",
@@ -3566,6 +3544,22 @@
        "node": "^14.15.0 || ^16.10.0 || >=18.0.0"
      }
    },
+    "node_modules/fast-content-type-parse": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/fast-content-type-parse/-/fast-content-type-parse-3.0.0.tgz",
+      "integrity": "sha512-ZvLdcY8P+N8mGQJahJV5G4U88CSvT1rP8ApL6uETe88MBXrBHAkZlSEySdUlyztF7ccb+Znos3TFqaepHxdhBg==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "MIT"
+    },
    "node_modules/fast-deep-equal": {
      "version": "3.1.3",
      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
@@ -4346,14 +4340,6 @@
        "node": ">=8"
      }
    },
-    "node_modules/is-plain-object": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/is-plain-object/-/is-plain-object-5.0.0.tgz",
-      "integrity": "sha512-VRSzKkbMm5jMDoKLbltAkFQ5Qr7VDiTFGXxYFXXowVj387GeGNOCsOH6Msy00SGZ3Fp84b1Naa1psqgcCIEP5Q==",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
    "node_modules/is-regex": {
      "version": "1.1.4",
      "resolved": "https://registry.npmjs.org/is-regex/-/is-regex-1.1.4.tgz",
@@ -5557,6 +5543,12 @@
      "integrity": "sha1-nbe1lJatPzz+8wp1FC0tkwrXJlE=",
      "dev": true
    },
+    "node_modules/json-with-bigint": {
+      "version": "3.5.8",
+      "resolved": "https://registry.npmjs.org/json-with-bigint/-/json-with-bigint-3.5.8.tgz",
+      "integrity": "sha512-eq/4KP6K34kwa7TcFdtvnftvHCD9KvHOGGICWwMFc4dOOKF5t4iYqnfLK8otCRCRv06FXOzGGyqE8h8ElMvvdw==",
+      "license": "MIT"
+    },
    "node_modules/json5": {
      "version": "2.2.3",
      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
@@ -5945,6 +5937,7 @@
      "version": "1.4.0",
      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
      "integrity": "sha1-WDsap3WWHUsROsF9nFC6753Xa9E=",
+      "dev": true,
      "dependencies": {
        "wrappy": "1"
      }
@@ -7113,14 +7106,16 @@
      }
    },
    "node_modules/undici-types": {
-      "version": "5.26.5",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-5.26.5.tgz",
-      "integrity": "sha512-JlCMO+ehdEIKqlFxk6IfVoAUVmgz7cU7zD/h9XZ0qzeosSHmUJVOzSQvvYSYWXkFXC+IfLKSIffhv0sVZup6pA=="
+      "version": "7.8.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.8.0.tgz",
+      "integrity": "sha512-9UJ2xGDvQ43tYyVMpuHlsgApydB8ZKfVYTsLDhXkFL/6gfkp+U8xTGdh8pMJv1SpZna0zxG1DwsKZsreLbXBxw==",
+      "license": "MIT"
    },
    "node_modules/universal-user-agent": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-6.0.0.tgz",
-      "integrity": "sha512-isyNax3wXoKaulPDZWHQqbmIx1k2tb9fb3GGDBRxCscfYV2Ch7WxPArBsFEG8s/safwXTT7H4QGhaIkTp9447w=="
+      "version": "7.0.3",
+      "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.3.tgz",
+      "integrity": "sha512-TmnEAEAsBJVZM/AADELsK76llnwcf9vMKuPz8JflO1frO8Lchitr0fNaN9d+Ap0BjKtqWqd/J17qeDnXh8CL2A==",
+      "license": "ISC"
    },
    "node_modules/untildify": {
      "version": "4.0.0",
@@ -7278,7 +7273,8 @@
    "node_modules/wrappy": {
      "version": "1.0.2",
      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
-      "integrity": "sha1-tSQ9jz7BqjXxNkYFvA0QNuMKtp8="
+      "integrity": "sha1-tSQ9jz7BqjXxNkYFvA0QNuMKtp8=",
+      "dev": true
    },
    "node_modules/write-file-atomic": {
      "version": "4.0.2",
@@ -7373,14 +7369,33 @@
      }
    },
    "@actions/github": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/@actions/github/-/github-6.0.0.tgz",
-      "integrity": "sha512-alScpSVnYmjNEXboZjarjukQEzgCRmjMv6Xj47fsdnqGS73bjJNDpiiXmp8jr0UZLdUB6d9jW63IcmddUP+l0g==",
+      "version": "9.1.0",
+      "resolved": "https://registry.npmjs.org/@actions/github/-/github-9.1.0.tgz",
+      "integrity": "sha512-u0hDGQeCS+7VNoLA8hYG65RLdPLMaPGfka0sZ0up7P0AiShqfX6xcuXNteGkQ7X7Tod7AMNwHd4p7DS63i8zzA==",
      "requires": {
-        "@actions/http-client": "^2.2.0",
-        "@octokit/core": "^5.0.1",
-        "@octokit/plugin-paginate-rest": "^9.0.0",
-        "@octokit/plugin-rest-endpoint-methods": "^10.0.0"
+        "@actions/http-client": "^3.0.2",
+        "@octokit/core": "^7.0.6",
+        "@octokit/plugin-paginate-rest": "^14.0.0",
+        "@octokit/plugin-rest-endpoint-methods": "^17.0.0",
+        "@octokit/request": "^10.0.7",
+        "@octokit/request-error": "^7.1.0",
+        "undici": "^6.23.0"
+      },
+      "dependencies": {
+        "@actions/http-client": {
+          "version": "3.0.2",
+          "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.2.tgz",
+          "integrity": "sha512-JP38FYYpyqvUsz+Igqlc/JG6YO9PaKuvqjM3iGvaLqFnJ7TFmcLyy2IDrY0bI0qCQug8E9K+elv5ZNfw62ZJzA==",
+          "requires": {
+            "tunnel": "^0.0.6",
+            "undici": "^6.23.0"
+          }
+        },
+        "undici": {
+          "version": "6.24.1",
+          "resolved": "https://registry.npmjs.org/undici/-/undici-6.24.1.tgz",
+          "integrity": "sha512-sC+b0tB1whOCzbtlx20fx3WgCXwkW627p4EA9uM+/tNNPkSS+eSEld6pAs9nDv7WbY1UUljBMYPtu9BCOrCWKA=="
+        }
      }
    },
    "@actions/glob": {
@@ -8303,169 +8318,107 @@
      }
    },
    "@octokit/auth-token": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-4.0.0.tgz",
-      "integrity": "sha512-tY/msAuJo6ARbK6SPIxZrPBms3xPbfwBrulZe0Wtr/DIY9lje2HeV1uoebShn6mx7SjCHif6EjMvoREj+gZ+SA=="
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-6.0.0.tgz",
+      "integrity": "sha512-P4YJBPdPSpWTQ1NU4XYdvHvXJJDxM6YwpS0FZHRgP7YFkdVxsWcpWGy/NVqlAA7PcPCnMacXlRm1y2PFZRWL/w=="
    },
    "@octokit/core": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/@octokit/core/-/core-5.0.1.tgz",
-      "integrity": "sha512-lyeeeZyESFo+ffI801SaBKmCfsvarO+dgV8/0gD8u1d87clbEdWsP5yC+dSj3zLhb2eIf5SJrn6vDz9AheETHw==",
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/@octokit/core/-/core-7.0.6.tgz",
+      "integrity": "sha512-DhGl4xMVFGVIyMwswXeyzdL4uXD5OGILGX5N8Y+f6W7LhC1Ze2poSNrkF/fedpVDHEEZ+PHFW0vL14I+mm8K3Q==",
      "requires": {
-        "@octokit/auth-token": "^4.0.0",
-        "@octokit/graphql": "^7.0.0",
-        "@octokit/request": "^8.0.2",
-        "@octokit/request-error": "^5.0.0",
-        "@octokit/types": "^12.0.0",
-        "before-after-hook": "^2.2.0",
-        "universal-user-agent": "^6.0.0"
+        "@octokit/auth-token": "^6.0.0",
+        "@octokit/graphql": "^9.0.3",
+        "@octokit/request": "^10.0.6",
+        "@octokit/request-error": "^7.0.2",
+        "@octokit/types": "^16.0.0",
+        "before-after-hook": "^4.0.0",
+        "universal-user-agent": "^7.0.0"
      }
    },
    "@octokit/endpoint": {
-      "version": "9.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-9.0.0.tgz",
-      "integrity": "sha512-szrQhiqJ88gghWY2Htt8MqUDO6++E/EIXqJ2ZEp5ma3uGS46o7LZAzSLt49myB7rT+Hfw5Y6gO3LmOxGzHijAQ==",
+      "version": "11.0.3",
+      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-11.0.3.tgz",
+      "integrity": "sha512-FWFlNxghg4HrXkD3ifYbS/IdL/mDHjh9QcsNyhQjN8dplUoZbejsdpmuqdA76nxj2xoWPs7p8uX2SNr9rYu0Ag==",
      "requires": {
-        "@octokit/types": "^11.0.0",
-        "is-plain-object": "^5.0.0",
-        "universal-user-agent": "^6.0.0"
-      },
-      "dependencies": {
-        "@octokit/openapi-types": {
-          "version": "18.0.0",
-          "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-18.0.0.tgz",
-          "integrity": "sha512-V8GImKs3TeQRxRtXFpG2wl19V7444NIOTDF24AWuIbmNaNYOQMWRbjcGDXV5B+0n887fgDcuMNOmlul+k+oJtw=="
-        },
-        "@octokit/types": {
-          "version": "11.1.0",
-          "resolved": "https://registry.npmjs.org/@octokit/types/-/types-11.1.0.tgz",
-          "integrity": "sha512-Fz0+7GyLm/bHt8fwEqgvRBWwIV1S6wRRyq+V6exRKLVWaKGsuy6H9QFYeBVDV7rK6fO3XwHgQOPxv+cLj2zpXQ==",
-          "requires": {
-            "@octokit/openapi-types": "^18.0.0"
-          }
-        }
+        "@octokit/types": "^16.0.0",
+        "universal-user-agent": "^7.0.2"
      }
    },
    "@octokit/graphql": {
-      "version": "7.0.1",
-      "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-7.0.1.tgz",
-      "integrity": "sha512-T5S3oZ1JOE58gom6MIcrgwZXzTaxRnxBso58xhozxHpOqSTgDS6YNeEUvZ/kRvXgPrRz/KHnZhtb7jUMRi9E6w==",
+      "version": "9.0.3",
+      "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-9.0.3.tgz",
+      "integrity": "sha512-grAEuupr/C1rALFnXTv6ZQhFuL1D8G5y8CN04RgrO4FIPMrtm+mcZzFG7dcBm+nq+1ppNixu+Jd78aeJOYxlGA==",
      "requires": {
-        "@octokit/request": "^8.0.1",
-        "@octokit/types": "^11.0.0",
-        "universal-user-agent": "^6.0.0"
-      },
-      "dependencies": {
-        "@octokit/openapi-types": {
-          "version": "18.0.0",
-          "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-18.0.0.tgz",
-          "integrity": "sha512-V8GImKs3TeQRxRtXFpG2wl19V7444NIOTDF24AWuIbmNaNYOQMWRbjcGDXV5B+0n887fgDcuMNOmlul+k+oJtw=="
-        },
-        "@octokit/types": {
-          "version": "11.1.0",
-          "resolved": "https://registry.npmjs.org/@octokit/types/-/types-11.1.0.tgz",
-          "integrity": "sha512-Fz0+7GyLm/bHt8fwEqgvRBWwIV1S6wRRyq+V6exRKLVWaKGsuy6H9QFYeBVDV7rK6fO3XwHgQOPxv+cLj2zpXQ==",
-          "requires": {
-            "@octokit/openapi-types": "^18.0.0"
-          }
-        }
+        "@octokit/request": "^10.0.6",
+        "@octokit/types": "^16.0.0",
+        "universal-user-agent": "^7.0.0"
      }
    },
    "@octokit/openapi-types": {
-      "version": "19.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-19.0.0.tgz",
-      "integrity": "sha512-PclQ6JGMTE9iUStpzMkwLCISFn/wDeRjkZFIKALpvJQNBGwDoYYi2fFvuHwssoQ1rXI5mfh6jgTgWuddeUzfWw=="
+      "version": "27.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-27.0.0.tgz",
+      "integrity": "sha512-whrdktVs1h6gtR+09+QsNk2+FO+49j6ga1c55YZudfEG+oKJVvJLQi3zkOm5JjiUXAagWK2tI2kTGKJ2Ys7MGA=="
    },
    "@octokit/plugin-paginate-rest": {
-      "version": "9.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-9.0.0.tgz",
-      "integrity": "sha512-oIJzCpttmBTlEhBmRvb+b9rlnGpmFgDtZ0bB6nq39qIod6A5DP+7RkVLMOixIgRCYSHDTeayWqmiJ2SZ6xgfdw==",
+      "version": "14.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-14.0.0.tgz",
+      "integrity": "sha512-fNVRE7ufJiAA3XUrha2omTA39M6IXIc6GIZLvlbsm8QOQCYvpq/LkMNGyFlB1d8hTDzsAXa3OKtybdMAYsV/fw==",
      "requires": {
-        "@octokit/types": "^12.0.0"
+        "@octokit/types": "^16.0.0"
      }
    },
    "@octokit/plugin-request-log": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-request-log/-/plugin-request-log-4.0.0.tgz",
-      "integrity": "sha512-2uJI1COtYCq8Z4yNSnM231TgH50bRkheQ9+aH8TnZanB6QilOnx8RMD2qsnamSOXtDj0ilxvevf5fGsBhBBzKA==",
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-request-log/-/plugin-request-log-6.0.0.tgz",
+      "integrity": "sha512-UkOzeEN3W91/eBq9sPZNQ7sUBvYCqYbrrD8gTbBuGtHEuycE4/awMXcYvx6sVYo7LypPhmQwwpUe4Yyu4QZN5Q==",
      "requires": {}
    },
    "@octokit/plugin-rest-endpoint-methods": {
-      "version": "10.0.1",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-10.0.1.tgz",
-      "integrity": "sha512-fgS6HPkPvJiz8CCliewLyym9qAx0RZ/LKh3sATaPfM41y/O2wQ4Z9MrdYeGPVh04wYmHFmWiGlKPC7jWVtZXQA==",
+      "version": "17.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-17.0.0.tgz",
+      "integrity": "sha512-B5yCyIlOJFPqUUeiD0cnBJwWJO8lkJs5d8+ze9QDP6SvfiXSz1BF+91+0MeI1d2yxgOhU/O+CvtiZ9jSkHhFAw==",
      "requires": {
-        "@octokit/types": "^12.0.0"
+        "@octokit/types": "^16.0.0"
      }
    },
    "@octokit/plugin-retry": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-retry/-/plugin-retry-6.0.1.tgz",
-      "integrity": "sha512-SKs+Tz9oj0g4p28qkZwl/topGcb0k0qPNX/i7vBKmDsjoeqnVfFUquqrE/O9oJY7+oLzdCtkiWSXLpLjvl6uog==",
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-retry/-/plugin-retry-8.1.0.tgz",
+      "integrity": "sha512-O1FZgXeiGb2sowEr/hYTr6YunGdSAFWnr2fyW39Ah85H8O33ELASQxcvOFF5LE6Tjekcyu2ms4qAzJVhSaJxTw==",
      "requires": {
-        "@octokit/request-error": "^5.0.0",
-        "@octokit/types": "^12.0.0",
+        "@octokit/request-error": "^7.0.2",
+        "@octokit/types": "^16.0.0",
        "bottleneck": "^2.15.3"
      }
    },
    "@octokit/request": {
-      "version": "8.1.1",
-      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-8.1.1.tgz",
-      "integrity": "sha512-8N+tdUz4aCqQmXl8FpHYfKG9GelDFd7XGVzyN8rc6WxVlYcfpHECnuRkgquzz+WzvHTK62co5di8gSXnzASZPQ==",
+      "version": "10.0.8",
+      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-10.0.8.tgz",
+      "integrity": "sha512-SJZNwY9pur9Agf7l87ywFi14W+Hd9Jg6Ifivsd33+/bGUQIjNujdFiXII2/qSlN2ybqUHfp5xpekMEjIBTjlSw==",
      "requires": {
-        "@octokit/endpoint": "^9.0.0",
-        "@octokit/request-error": "^5.0.0",
-        "@octokit/types": "^11.1.0",
-        "is-plain-object": "^5.0.0",
-        "universal-user-agent": "^6.0.0"
-      },
-      "dependencies": {
-        "@octokit/openapi-types": {
-          "version": "18.0.0",
-          "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-18.0.0.tgz",
-          "integrity": "sha512-V8GImKs3TeQRxRtXFpG2wl19V7444NIOTDF24AWuIbmNaNYOQMWRbjcGDXV5B+0n887fgDcuMNOmlul+k+oJtw=="
-        },
-        "@octokit/types": {
-          "version": "11.1.0",
-          "resolved": "https://registry.npmjs.org/@octokit/types/-/types-11.1.0.tgz",
-          "integrity": "sha512-Fz0+7GyLm/bHt8fwEqgvRBWwIV1S6wRRyq+V6exRKLVWaKGsuy6H9QFYeBVDV7rK6fO3XwHgQOPxv+cLj2zpXQ==",
-          "requires": {
-            "@octokit/openapi-types": "^18.0.0"
-          }
-        }
+        "@octokit/endpoint": "^11.0.3",
+        "@octokit/request-error": "^7.0.2",
+        "@octokit/types": "^16.0.0",
+        "fast-content-type-parse": "^3.0.0",
+        "json-with-bigint": "^3.5.3",
+        "universal-user-agent": "^7.0.2"
      }
    },
    "@octokit/request-error": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-5.0.0.tgz",
-      "integrity": "sha512-1ue0DH0Lif5iEqT52+Rf/hf0RmGO9NWFjrzmrkArpG9trFfDM/efx00BJHdLGuro4BR/gECxCU2Twf5OKrRFsQ==",
+      "version": "7.1.0",
+      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-7.1.0.tgz",
+      "integrity": "sha512-KMQIfq5sOPpkQYajXHwnhjCC0slzCNScLHs9JafXc4RAJI+9f+jNDlBNaIMTvazOPLgb4BnlhGJOTbnN0wIjPw==",
      "requires": {
-        "@octokit/types": "^11.0.0",
-        "deprecation": "^2.0.0",
-        "once": "^1.4.0"
-      },
-      "dependencies": {
-        "@octokit/openapi-types": {
-          "version": "18.0.0",
-          "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-18.0.0.tgz",
-          "integrity": "sha512-V8GImKs3TeQRxRtXFpG2wl19V7444NIOTDF24AWuIbmNaNYOQMWRbjcGDXV5B+0n887fgDcuMNOmlul+k+oJtw=="
-        },
-        "@octokit/types": {
-          "version": "11.1.0",
-          "resolved": "https://registry.npmjs.org/@octokit/types/-/types-11.1.0.tgz",
-          "integrity": "sha512-Fz0+7GyLm/bHt8fwEqgvRBWwIV1S6wRRyq+V6exRKLVWaKGsuy6H9QFYeBVDV7rK6fO3XwHgQOPxv+cLj2zpXQ==",
-          "requires": {
-            "@octokit/openapi-types": "^18.0.0"
-          }
-        }
+        "@octokit/types": "^16.0.0"
      }
    },
    "@octokit/types": {
-      "version": "12.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-12.0.0.tgz",
-      "integrity": "sha512-EzD434aHTFifGudYAygnFlS1Tl6KhbTynEWELQXIbTY8Msvb5nEqTZIm7sbPEt4mQYLZwu3zPKVdeIrw0g7ovg==",
+      "version": "16.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-16.0.0.tgz",
+      "integrity": "sha512-sKq+9r1Mm4efXW1FCk7hFSeJo4QKreL/tTbR0rz/qx/r1Oa2VV83LTA/H/MuCOX7uCIJmQVRKBcbmWoySjAnSg==",
      "requires": {
-        "@octokit/openapi-types": "^19.0.0"
+        "@octokit/openapi-types": "^27.0.0"
      }
    },
    "@pkgr/utils": {
@@ -8652,11 +8605,11 @@
      "dev": true
    },
    "@types/node": {
-      "version": "20.9.0",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-20.9.0.tgz",
-      "integrity": "sha512-nekiGu2NDb1BcVofVcEKMIwzlx4NjHlcjhoxxKBNLtz15Y1z7MYf549DFvkHSId02Ax6kGwWntIBPC3l/JZcmw==",
+      "version": "24.1.0",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.1.0.tgz",
+      "integrity": "sha512-ut5FthK5moxFKH2T1CUOC6ctR67rQRvvHdFLCD2Ql6KXmMuCrjsSsRI9UsLCm9M18BMwClv4pn327UvB7eeO1w==",
      "requires": {
-        "undici-types": "~5.26.4"
+        "undici-types": "~7.8.0"
      }
    },
    "@types/semver": {
@@ -9040,9 +8993,9 @@
      "integrity": "sha1-ibTRmasr7kneFk6gK4nORi1xt2c="
    },
    "before-after-hook": {
-      "version": "2.2.2",
-      "resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-2.2.2.tgz",
-      "integrity": "sha512-3pZEU3NT5BFUo/AD5ERPWOgQOCZITni6iavr5AUw5AUwQjMlI0kzu5btnyD39AF0gUEsDPwJT+oY1ORBJijPjQ=="
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-4.0.0.tgz",
+      "integrity": "sha512-q6tR3RPqIB1pMiTRMFcZwuG5T8vwp+vUvEG0vuI6B+Rikh5BfPp2fQ82c925FOs+b0lcFQ8CFrL+KbilfZFhOQ=="
    },
    "big-integer": {
      "version": "1.6.51",
@@ -9502,11 +9455,6 @@
        "object-keys": "^1.1.1"
      }
    },
-    "deprecation": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/deprecation/-/deprecation-2.3.1.tgz",
-      "integrity": "sha512-xmHIy4F3scKVwMsQ4WnVaS8bHOx0DmVwRywosKhaILI0ywMDWPtBSku2HNxRvF7jtwDRsoEwYQSfbxj8b7RlJQ=="
-    },
    "detect-newline": {
      "version": "3.1.0",
      "resolved": "https://registry.npmjs.org/detect-newline/-/detect-newline-3.1.0.tgz",
@@ -9969,6 +9917,11 @@
        }
      }
    },
+    "fast-content-type-parse": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/fast-content-type-parse/-/fast-content-type-parse-3.0.0.tgz",
+      "integrity": "sha512-ZvLdcY8P+N8mGQJahJV5G4U88CSvT1rP8ApL6uETe88MBXrBHAkZlSEySdUlyztF7ccb+Znos3TFqaepHxdhBg=="
+    },
    "fast-deep-equal": {
      "version": "3.1.3",
      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
@@ -10518,11 +10471,6 @@
      "integrity": "sha512-Fd4gABb+ycGAmKou8eMftCupSir5lRxqf4aD/vd0cD2qc4HL07OjCeuHMr8Ro4CoMaeCKDB0/ECBOVWjTwUvPQ==",
      "dev": true
    },
-    "is-plain-object": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/is-plain-object/-/is-plain-object-5.0.0.tgz",
-      "integrity": "sha512-VRSzKkbMm5jMDoKLbltAkFQ5Qr7VDiTFGXxYFXXowVj387GeGNOCsOH6Msy00SGZ3Fp84b1Naa1psqgcCIEP5Q=="
-    },
    "is-regex": {
      "version": "1.1.4",
      "resolved": "https://registry.npmjs.org/is-regex/-/is-regex-1.1.4.tgz",
@@ -11428,6 +11376,11 @@
      "integrity": "sha1-nbe1lJatPzz+8wp1FC0tkwrXJlE=",
      "dev": true
    },
+    "json-with-bigint": {
+      "version": "3.5.8",
+      "resolved": "https://registry.npmjs.org/json-with-bigint/-/json-with-bigint-3.5.8.tgz",
+      "integrity": "sha512-eq/4KP6K34kwa7TcFdtvnftvHCD9KvHOGGICWwMFc4dOOKF5t4iYqnfLK8otCRCRv06FXOzGGyqE8h8ElMvvdw=="
+    },
    "json5": {
      "version": "2.2.3",
      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
@@ -11735,6 +11688,7 @@
      "version": "1.4.0",
      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
      "integrity": "sha1-WDsap3WWHUsROsF9nFC6753Xa9E=",
+      "dev": true,
      "requires": {
        "wrappy": "1"
      }
@@ -12542,14 +12496,14 @@
      }
    },
    "undici-types": {
-      "version": "5.26.5",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-5.26.5.tgz",
-      "integrity": "sha512-JlCMO+ehdEIKqlFxk6IfVoAUVmgz7cU7zD/h9XZ0qzeosSHmUJVOzSQvvYSYWXkFXC+IfLKSIffhv0sVZup6pA=="
+      "version": "7.8.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.8.0.tgz",
+      "integrity": "sha512-9UJ2xGDvQ43tYyVMpuHlsgApydB8ZKfVYTsLDhXkFL/6gfkp+U8xTGdh8pMJv1SpZna0zxG1DwsKZsreLbXBxw=="
    },
    "universal-user-agent": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-6.0.0.tgz",
-      "integrity": "sha512-isyNax3wXoKaulPDZWHQqbmIx1k2tb9fb3GGDBRxCscfYV2Ch7WxPArBsFEG8s/safwXTT7H4QGhaIkTp9447w=="
+      "version": "7.0.3",
+      "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.3.tgz",
+      "integrity": "sha512-TmnEAEAsBJVZM/AADELsK76llnwcf9vMKuPz8JflO1frO8Lchitr0fNaN9d+Ap0BjKtqWqd/J17qeDnXh8CL2A=="
    },
    "untildify": {
      "version": "4.0.0",
@@ -12660,7 +12614,8 @@
    "wrappy": {
      "version": "1.0.2",
      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
-      "integrity": "sha1-tSQ9jz7BqjXxNkYFvA0QNuMKtp8="
+      "integrity": "sha1-tSQ9jz7BqjXxNkYFvA0QNuMKtp8=",
+      "dev": true
    },
    "write-file-atomic": {
      "version": "4.0.2",
@@ -1,18 +1,17 @@
 {
  "name": "@actions/github-script",
  "description": "A GitHub action for executing a simple script",
-  "version": "7.0.1",
+  "engines": {
+    "node": ">=24"
+  },
+  "version": "9.0.0",
  "author": "GitHub",
  "license": "MIT",
  "main": "dist/index.js",
  "types": "types/async-function.d.ts",
-  "private": true,
-  "engines": {
-    "node": ">=20.0.0 <21.0.0"
-  },
  "scripts": {
    "build": "npm run build:types && ncc build src/main.ts",
-    "build:types": "tsc src/async-function.ts -t es5 --declaration --allowJs --emitDeclarationOnly --outDir types",
+    "build:types": "tsc src/async-function.ts --target es2022 --module es2022 --moduleResolution bundler --declaration --emitDeclarationOnly --outDir types",
    "format:check": "prettier --check src __test__",
    "format:write": "prettier --write src __test__",
    "lint": "eslint src __test__",
@@ -29,6 +28,11 @@
      "^.+\\.ts$": [
        "ts-jest",
        {
+          "tsconfig": {
+            "target": "es2022",
+            "module": "commonjs",
+            "moduleResolution": "bundler"
+          },
          "diagnostics": {
            "ignoreCodes": [
              "151001"
@@ -41,13 +45,13 @@
  "dependencies": {
    "@actions/core": "^1.10.1",
    "@actions/exec": "^1.1.1",
-    "@actions/github": "^6.0.0",
+    "@actions/github": "^9.0.0",
    "@actions/glob": "^0.4.0",
    "@actions/io": "^1.1.3",
-    "@octokit/core": "^5.0.1",
-    "@octokit/plugin-request-log": "^4.0.0",
-    "@octokit/plugin-retry": "^6.0.1",
-    "@types/node": "^20.9.0"
+    "@octokit/core": "^7.0.0",
+    "@octokit/plugin-request-log": "^6.0.0",
+    "@octokit/plugin-retry": "^8.0.0",
+    "@types/node": "^24.1.0"
  },
  "devDependencies": {
    "@types/jest": "^29.5.5",
@@ -1,16 +1,17 @@
 import * as core from '@actions/core'
 import * as exec from '@actions/exec'
-import {Context} from '@actions/github/lib/context'
-import {GitHub} from '@actions/github/lib/utils'
+import type {context, getOctokit} from '@actions/github'
 import * as glob from '@actions/glob'
 import * as io from '@actions/io'

 const AsyncFunction = Object.getPrototypeOf(async () => null).constructor

 export declare type AsyncFunctionArguments = {
-  context: Context
+  context: typeof context
  core: typeof core
-  github: InstanceType<typeof GitHub>
+  github: ReturnType<typeof getOctokit>
+  octokit: ReturnType<typeof getOctokit>
+  getOctokit: typeof getOctokit
  exec: typeof exec
  glob: typeof glob
  io: typeof io
@@ -0,0 +1,64 @@
+import {getOctokit} from '@actions/github'
+
+/**
+ * Strip keys whose value is `undefined` so they don't clobber defaults
+ * during object spread (e.g. `{baseUrl: undefined}` would wipe a GHES URL).
+ */
+function stripUndefined(obj: Record<string, unknown>): Record<string, unknown> {
+  return Object.fromEntries(
+    Object.entries(obj).filter(([, v]) => v !== undefined)
+  )
+}
+
+/**
+ * Creates a wrapped getOctokit that inherits default options and plugins.
+ * Secondary clients created via the wrapper get the same retry, logging,
+ * orchestration ID, and retries count as the pre-built `github` client.
+ *
+ * - `request` and `retry` are deep-merged so partial overrides
+ *   (e.g. `{request: {timeout: 5000}}`) don't clobber inherited values.
+ * - `undefined` values in both default and user options are stripped to prevent
+ *   accidental clobbering (e.g. GHES `baseUrl`, or `log: undefined` from defaults).
+ * - Default plugins (retry, requestLog) are always included; duplicates are skipped.
+ */
+export function createConfiguredGetOctokit(
+  rawGetOctokit: typeof getOctokit,
+  defaultOptions: Record<string, unknown>,
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  ...defaultPlugins: any[]
+): typeof getOctokit {
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  return ((token: string, options?: any, ...plugins: any[]) => {
+    const cleanDefaults = stripUndefined(defaultOptions)
+    const userOpts = stripUndefined(options ?? {})
+
+    const defaultRequest =
+      (cleanDefaults.request as Record<string, unknown> | undefined) ?? {}
+    const userRequest = stripUndefined(
+      (userOpts.request as Record<string, unknown> | undefined) ?? {}
+    )
+
+    const defaultRetry =
+      (cleanDefaults.retry as Record<string, unknown> | undefined) ?? {}
+    const userRetry = stripUndefined(
+      (userOpts.retry as Record<string, unknown> | undefined) ?? {}
+    )
+
+    const merged = {
+      ...cleanDefaults,
+      ...userOpts,
+      request: {...defaultRequest, ...userRequest},
+      retry: {...defaultRetry, ...userRetry}
+    }
+
+    // Deduplicate: default plugins first, then user plugins that aren't already present
+    const allPlugins = [...defaultPlugins]
+    for (const plugin of plugins) {
+      if (!allPlugins.includes(plugin)) {
+        allPlugins.push(plugin)
+      }
+    }
+
+    return rawGetOctokit(token, merged, ...allPlugins)
+  }) as typeof getOctokit
+}
@@ -8,6 +8,7 @@ import {requestLog} from '@octokit/plugin-request-log'
 import {retry} from '@octokit/plugin-retry'
 import {RequestRequestOptions} from '@octokit/types'
 import {callAsyncFunction} from './async-function'
+import {createConfiguredGetOctokit} from './create-configured-getoctokit'
 import {RetryOptions, getRetryOptions, parseNumberArray} from './retry-options'
 import {wrapRequire} from './wrap-require'

@@ -39,9 +40,12 @@ async function main(): Promise<void> {
    defaultGitHubOptions
  )

+  const baseUserAgent = userAgent || 'actions/github-script'
+  const finalUserAgent = getUserAgentWithOrchestrationId(baseUserAgent)
+
  const opts: Options = {
    log: debug ? console : undefined,
-    userAgent: userAgent || undefined,
+    userAgent: finalUserAgent,
    previews: previews ? previews.split(',') : undefined,
    retry: retryOpts,
    request: requestOpts
@@ -56,12 +60,24 @@ async function main(): Promise<void> {
  const github = getOctokit(token, opts, retry, requestLog)
  const script = core.getInput('script', {required: true})

+  // Wrap getOctokit so secondary clients inherit retry, logging,
+  // orchestration ID, and the action's retries input.
+  // Deep-copy opts to prevent shared references with the primary client.
+  const configuredGetOctokit = createConfiguredGetOctokit(
+    getOctokit,
+    {...opts, retry: {...opts.retry}, request: {...opts.request}},
+    retry,
+    requestLog
+  )
+
  // Using property/value shorthand on `require` (e.g. `{require}`) causes compilation errors.
  const result = await callAsyncFunction(
    {
      require: wrapRequire,
      __original_require__: __non_webpack_require__,
      github,
+      octokit: github,
+      getOctokit: configuredGetOctokit,
      context,
      core,
      exec,
@@ -95,3 +111,20 @@ function handleError(err: any): void {
  console.error(err)
  core.setFailed(`Unhandled error: ${err}`)
 }
+
+/**
+ * Gets the user agent string with orchestration ID appended if available
+ * @param userAgent The base user agent string
+ * @returns The user agent string with orchestration ID appended if ACTIONS_ORCHESTRATION_ID is set
+ */
+function getUserAgentWithOrchestrationId(userAgent: string): string {
+  const orchestrationId = process.env['ACTIONS_ORCHESTRATION_ID']
+  if (!orchestrationId) {
+    return userAgent
+  }
+
+  // Sanitize orchestration ID - replace invalid characters with underscore
+  const sanitized = orchestrationId.replace(/[^a-zA-Z0-9._-]/g, '_')
+
+  return `${userAgent} actions_orchestration_id/${sanitized}`
+}
@@ -1,5 +1,5 @@
 import * as core from '@actions/core'
-import {OctokitOptions} from '@octokit/core/dist-types/types'
+import {OctokitOptions} from '@octokit/core/types'
 import {RequestRequestOptions} from '@octokit/types'

 export type RetryOptions = {
@@ -1,7 +1,8 @@
 {
  "compilerOptions": {
-    "target": "es2018",
-    "moduleResolution": "node",
+    "target": "es2022",
+    "module": "es2022",
+    "moduleResolution": "bundler",
    "strict": true,
    "forceConsistentCasingInFileNames": true
  },
@@ -1,14 +1,15 @@
 /// <reference types="node" />
 import * as core from '@actions/core';
 import * as exec from '@actions/exec';
-import { Context } from '@actions/github/lib/context';
-import { GitHub } from '@actions/github/lib/utils';
+import type { context, getOctokit } from '@actions/github';
 import * as glob from '@actions/glob';
 import * as io from '@actions/io';
 export declare type AsyncFunctionArguments = {
-    context: Context;
+    context: typeof context;
    core: typeof core;
-    github: InstanceType<typeof GitHub>;
+    github: ReturnType<typeof getOctokit>;
+    octokit: ReturnType<typeof getOctokit>;
+    getOctokit: typeof getOctokit;
    exec: typeof exec;
    glob: typeof glob;
    io: typeof io;
Author	SHA1	Message	Date
Salman Chishti	3a2844b7e9	Merge pull request #700 from actions/salmanmkc/expose-getoctokit + prepare release for v9 feat!: add getOctokit to script context, upgrade @actions/github v9, @octokit/core v7, and related packages	2026-04-09 23:39:54 +01:00
Salman Muin Kayser Chishti	ca10bbdd1a	fix: use @octokit/core/types import for v7 compatibility The merge from main incorrectly used the v5 import path (@octokit/core/dist-types/types). v7 exports types via @octokit/core/types in its package.json exports map. Rebuild dist with correct dependency resolution.	2026-04-09 22:14:16 +01:00
Salman Muin Kayser Chishti	86e48e20ac	merge: incorporate main branch changes - Resolve integration.yml merge conflicts (user-agent assertions) - Fix OctokitOptions import path to @octokit/core/dist-types/types - Rebuild dist	2026-04-09 22:10:00 +01:00
Salman Muin Kayser Chishti	c1084728b5	chore: rebuild dist for v9 upgrade and getOctokit factory	2026-04-09 22:02:13 +01:00
Salman Chishti	afff112e4f	Merge pull request #712 from actions/salmanmkc/deployment-false + fix user-agent test to handle orchestration ID ci: use deployment: false for integration test environments	2026-04-09 21:40:10 +01:00
Salman Muin Kayser Chishti	ff8117e5b7	ci: fix user-agent test to handle orchestration ID	2026-04-09 19:24:48 +00:00
Salman Muin Kayser Chishti	81c6b78760	ci: use deployment: false to suppress deployment noise from integration tests	2026-04-09 19:02:40 +00:00
Salman Muin Kayser Chishti	3953caf885	docs: update README examples from @v8 to @v9, add getOctokit docs and v9 breaking changes	2026-04-09 19:16:01 +01:00
Salman Muin Kayser Chishti	c17d55b90d	ci: add getOctokit integration test job	2026-04-09 19:16:00 +01:00
Salman Muin Kayser Chishti	a047196d9a	test: add getOctokit integration tests via callAsyncFunction	2026-04-09 19:15:58 +01:00
Salman Muin Kayser Chishti	3d149a5dc3	test: add getOctokit context tests to async-function suite	2026-04-09 19:15:56 +01:00
Salman Muin Kayser Chishti	73b5e99fba	test: add 16 unit tests for getOctokit factory	2026-04-09 19:15:54 +01:00
Salman Muin Kayser Chishti	19ac6e42c0	feat: wire getOctokit factory into script context	2026-04-09 19:15:53 +01:00
Salman Muin Kayser Chishti	0c2c53e809	feat: add getOctokit factory with deep merge, stripUndefined, and plugin dedup	2026-04-09 19:15:51 +01:00
Salman Muin Kayser Chishti	652783f052	types: update type declarations to match v9 async-function changes	2026-04-09 19:15:49 +01:00
Salman Muin Kayser Chishti	af48da85cb	refactor: update async-function types for v9 imports, add getOctokit to arguments	2026-04-09 19:15:47 +01:00
Salman Muin Kayser Chishti	926497b406	refactor: update OctokitOptions import path for v9	2026-04-09 19:15:46 +01:00
Salman Muin Kayser Chishti	26bb776791	chore: refresh license cache for upgraded dependencies	2026-04-09 19:15:43 +01:00
Salman Muin Kayser Chishti	84e9b9d216	build: switch to ES2022 target with bundler module resolution	2026-04-09 19:15:41 +01:00
Salman Muin Kayser Chishti	34cab63564	chore: update package-lock.json for v9 dependencies	2026-04-09 19:15:39 +01:00
Salman Muin Kayser Chishti	ff4b64fc28	feat!: bump version to 9.0.0, upgrade @actions/github to v9	2026-04-09 19:15:31 +01:00
Tingluo Huang	450193c5ab	Merge pull request #695 from actions/copilot/add-orchestration-id-user-agent Add ACTIONS_ORCHESTRATION_ID to user-agent string	2026-01-07 10:23:37 -05:00
copilot-swe-agent[bot]	b67a972797	Change orchestration ID format to actions_orchestration_id Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>	2026-01-07 04:17:15 +00:00
copilot-swe-agent[bot]	c0078b2072	Simplify user-agent logic and update integration test Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>	2026-01-06 23:05:20 +00:00
copilot-swe-agent[bot]	c36bdc0a3a	Fix user-agent to handle empty string correctly Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>	2026-01-06 22:55:13 +00:00
copilot-swe-agent[bot]	b588811d63	Revert package-lock.json changes to remove peer flags Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>	2026-01-06 22:46:11 +00:00
copilot-swe-agent[bot]	135f4fc944	Replace invalid characters with underscore instead of removing them Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>	2026-01-06 22:39:03 +00:00
copilot-swe-agent[bot]	8a9be95424	Move helper method to end of file and revert package-lock.json changes Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>	2026-01-06 22:30:38 +00:00
copilot-swe-agent[bot]	728b23b52d	Remove orchestration-id test file Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>	2026-01-06 22:22:39 +00:00
copilot-swe-agent[bot]	f80dad6b51	Add underscore to valid orchestration ID characters Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>	2026-01-06 21:27:04 +00:00
copilot-swe-agent[bot]	baada7bb39	Apply prettier formatting to test file Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>	2026-01-06 21:15:37 +00:00
copilot-swe-agent[bot]	d053ab3e3c	Add ACTIONS_ORCHESTRATION_ID to user-agent string Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>	2026-01-06 21:10:26 +00:00
copilot-swe-agent[bot]	4389015762	Initial plan for ACTIONS_ORCHESTRATION_ID user-agent support Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>	2026-01-06 21:07:40 +00:00
copilot-swe-agent[bot]	6599b4813b	Initial plan	2026-01-06 21:02:44 +00:00
Sneha Kripanandan	ed597411d8	Merge pull request #653 from actions/sneha-krip/readme-for-v8 README for updating actions/github-script from v7 to v8	2025-09-04 10:48:16 -04:00
Sneha Kripanandan	2dc352e4ba	Bold minimum Actions Runner version in README	2025-09-04 10:43:07 -04:00
Sneha Kripanandan	01e118c8d0	Update README for Node 24 runtime requirements	2025-09-04 10:42:40 -04:00
Sneha Kripanandan	8b222ac82e	Apply suggestion from @salmanmkc Co-authored-by: Salman Chishti <salmanmkc@GitHub.com>	2025-09-04 10:39:58 -04:00
Sneha Kripanandan	adc0eeac99	README for updating actions/github-script from v7 to v8	2025-09-04 10:27:46 -04:00
Salman Chishti	20fe497b3f	Merge pull request #637 from actions/node24 Update Node.js version support to 24.x	2025-09-04 10:55:50 +01:00
Salman Muin Kayser Chishti	e7b7f222b1	update licenses	2025-08-08 12:15:47 +01:00
Salman Muin Kayser Chishti	2c81ba05f3	Update Node.js version support to 24.x Bump Node.js version requirement from 20.x to 24.x in action configuration and package files. Update @types/node and undici-types dependencies to match Node 24 compatibility.	2025-07-29 14:08:35 +01:00
Ben De St Paer-Gotch	f28e40c7f3	Merge pull request #610 from actions/nebuk89-patch-1 Update README.md	2025-06-06 09:19:36 +01:00
Ben De St Paer-Gotch	1ae9958572	Update README.md	2025-06-02 10:34:00 +01:00
Josh Gross	5ee2b97722	Merge pull request #603 from actions/joshmgross/document-inputs Clearly document passing inputs to the `script`	2025-05-14 10:27:18 -04:00
Josh Gross	3424b52d08	typo fixes	2025-05-13 11:04:53 -04:00
Josh Gross	f9d8109d52	Clearly document passing inputs to the `script`	2025-05-13 10:53:59 -04:00
Josh Gross	e7aeb8c663	Merge pull request #575 from actions/dependabot/github_actions/ruby/setup-ruby-1.229.0 Bump ruby/setup-ruby from 1.222.0 to 1.229.0	2025-04-02 10:56:06 -04:00
dependabot[bot]	5b5837ac81	Bump ruby/setup-ruby from 1.222.0 to 1.229.0 Bumps [ruby/setup-ruby](https://github.com/ruby/setup-ruby) from 1.222.0 to 1.229.0. - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](https://github.com/ruby/setup-ruby/compare/277ba2a127aba66d45bad0fa2dc56f80dbfedffa...354a1ad156761f5ee2b7b13fa8e09943a5e8d252) --- updated-dependencies: - dependency-name: ruby/setup-ruby dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2025-03-31 19:45:58 +00:00
Josh Gross	3908079ba1	Merge pull request #563 from actions/dependabot/github_actions/ruby/setup-ruby-1.222.0 Bump ruby/setup-ruby from 1.213.0 to 1.222.0	2025-03-10 15:14:55 -04:00
dependabot[bot]	14b73c4a7e	Bump ruby/setup-ruby from 1.213.0 to 1.222.0 Bumps [ruby/setup-ruby](https://github.com/ruby/setup-ruby) from 1.213.0 to 1.222.0. - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](https://github.com/ruby/setup-ruby/compare/28c4deda893d5a96a6b2d958c5b47fc18d65c9d3...277ba2a127aba66d45bad0fa2dc56f80dbfedffa) --- updated-dependencies: - dependency-name: ruby/setup-ruby dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2025-03-10 19:08:31 +00:00
Josh Gross	62c3794a3e	Merge pull request #546 from neilime/patch-1 docs: add "exec" usage examples	2025-03-05 15:32:44 -05:00
Emilien Escalle	ea5430244c	Merge branch 'actions:main' into patch-1	2025-03-04 07:29:17 +01:00
Josh Gross	d0bdabac5f	Merge pull request #557 from actions/joshmgross/fix-readme-v7 Remove `octokit` README updates for v7	2025-02-26 14:46:35 -05:00
Josh Gross	851500a2ad	Remove `octokit` README updates for v7 https://github.com/actions/github-script/issues/545	2025-02-26 14:38:00 -05:00
Emilien Escalle	86ac1371ea	docs: add "exec" usage examples	2025-02-17 11:50:46 +01:00
Josh Gross	378a50fac5	Merge pull request #508 from iamstarkov/patch-2 make octokit instance available as octokit on top of github, to make it easier to seamlessly copy examples from GitHub rest api or octokit documentations	2025-02-04 14:47:03 -05:00
Vladimir Starkov	632050422e	fix: adjust types	2025-01-31 11:55:53 +01:00
Vladimir Starkov	f23cd47e29	replace GitHub with octokit in the README, but keep a note of the GitHub still being available	2025-01-31 11:20:25 +01:00
Vladimir Starkov	4024541289	make octokit instance available as octokit on top of github, to make it easier to seamless to copy examples from GitHub api or octokit documentation	2025-01-31 11:20:25 +01:00
Josh Gross	91a83c0917	Merge pull request #473 from nschonni/upstream-setup-license ci: Use github/setup-licensed	2025-01-29 11:34:59 -05:00
Josh Gross	586a6a1c85	Merge branch 'main' into upstream-setup-license	2025-01-29 11:31:44 -05:00
Josh Gross	8cf50d1501	Merge pull request #533 from nschonni/remove-vscode chore: Remove .vscode settings	2025-01-29 11:30:27 -05:00
Josh Gross	511abaae1c	Merge branch 'main' into remove-vscode	2025-01-29 11:22:32 -05:00
Josh Gross	eb88965f42	Merge pull request #532 from nschonni/sub-action-dependabot chore: Add Dependabot for .github/actions/install-dependencies	2025-01-29 11:22:24 -05:00
Josh Gross	eef4fd9090	Merge branch 'main' into remove-vscode	2025-01-29 11:22:16 -05:00
Josh Gross	6efc7571cb	Merge branch 'main' into sub-action-dependabot	2025-01-29 11:21:01 -05:00
Josh Gross	08caaddc54	Merge pull request #531 from actions/joshmgross/update-workflows Define `permissions` in workflows and update actions	2025-01-29 11:20:46 -05:00
Nick Schonning	ac230a1936	chore: Remove .vscode settings	2025-01-28 17:18:57 -05:00
Nick Schonning	8e643f1530	chore: Add Dependabot for .github/actions/install-dependencies	2025-01-28 17:04:29 -05:00
Josh Gross	19e58d8525	Define `permissions` in workflows and update actions	2025-01-28 16:50:07 -05:00
Nick Schonning	fd2cfc12fa	ci: pin ruby/setup-ruby	2025-01-25 16:18:58 -05:00
Nick Schonning	f2f7f58db4	ci: Use github/setup-licensed	2025-01-25 16:15:22 -05:00