Merge pull request #700 from actions/salmanmkc/expose-getoctokit + prepare release for v9

feat!: add getOctokit to script context, upgrade @actions/github v9, @octokit/core v7, and related packages

.github/workflows/integration.yml

@@ -42,7 +42,8 @@ jobs:
           result-encoding: string
       - run: |
           echo "- Validating relative require output"
-          if [[ "${{steps.relative-require.outputs.result}}" != "@actions/github-script" ]]; then
+          expected="@actions/github-script"
+          if [[ "${{steps.relative-require.outputs.result}}" != "$expected" ]]; then
             echo $'::error::\u274C' "Expected '$expected', got ${{steps.relative-require.outputs.result}}"
             exit 1
           fi
@@ -154,22 +155,54 @@ jobs:
             return endpoint({}).headers['user-agent']
           result-encoding: string
       - run: |
+          # User-agent format: <prefix> [actions_orchestration_id/<id>] octokit-core.js/<version> ...
+          # When ACTIONS_ORCHESTRATION_ID is set, the orchestration ID is inserted after the prefix
           echo "- Validating user-agent default"
           ua="${{steps.user-agent-default.outputs.result}}"
-          if [[ "$ua" != "actions/github-script octokit-core.js/"* ]] && [[ "$ua" != "actions/github-script actions_orchestration_id/"* ]]; then
-            echo $'::error::\u274C' "Expected user-agent to start with 'actions/github-script', got $ua"
+          if [[ "$ua" != "actions/github-script"* ]] || [[ "$ua" != *"octokit-core.js/"* ]]; then
+            echo $'::error::\u274C' "Expected user-agent to start with 'actions/github-script' and contain 'octokit-core.js/', got $ua"
             exit 1
           fi
           echo "- Validating user-agent set to a value"
           ua="${{steps.user-agent-set.outputs.result}}"
-          if [[ "$ua" != "foobar octokit-core.js/"* ]] && [[ "$ua" != "foobar actions_orchestration_id/"* ]]; then
-            echo $'::error::\u274C' "Expected user-agent to start with 'foobar', got $ua"
+          if [[ "$ua" != "foobar"* ]] || [[ "$ua" != *"octokit-core.js/"* ]]; then
+            echo $'::error::\u274C' "Expected user-agent to start with 'foobar' and contain 'octokit-core.js/', got $ua"
             exit 1
           fi
           echo "- Validating user-agent set to an empty string"
           ua="${{steps.user-agent-empty.outputs.result}}"
-          if [[ "$ua" != "actions/github-script octokit-core.js/"* ]] && [[ "$ua" != "actions/github-script actions_orchestration_id/"* ]]; then
-            echo $'::error::\u274C' "Expected user-agent to start with 'actions/github-script', got $ua"
+          if [[ "$ua" != "actions/github-script"* ]] || [[ "$ua" != *"octokit-core.js/"* ]]; then
+            echo $'::error::\u274C' "Expected user-agent to start with 'actions/github-script' and contain 'octokit-core.js/', got $ua"
+            exit 1
+          fi
+          echo $'\u2705 Test passed' | tee -a $GITHUB_STEP_SUMMARY
+
+  test-get-octokit:
+    name: 'Integration test: getOctokit with token'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/install-dependencies
+      - id: secondary-client
+        name: Create a second client with getOctokit
+        uses: ./
+        env:
+          APP_TOKEN: ${{ github.token }}
+        with:
+          script: |
+            const appOctokit = getOctokit(process.env.APP_TOKEN)
+            const {data} = await appOctokit.rest.repos.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo
+            })
+
+            return `${appOctokit !== github}:${data.full_name}`
+          result-encoding: string
+      - run: |
+          echo "- Validating secondary client output"
+          expected="true:${{ github.repository }}"
+          if [[ "${{steps.secondary-client.outputs.result}}" != "$expected" ]]; then
+            echo $'::error::\u274C' "Expected '$expected', got ${{steps.secondary-client.outputs.result}}"
             exit 1
           fi
           echo $'\u2705 Test passed' | tee -a $GITHUB_STEP_SUMMARY

README.md

@@ -9,7 +9,7 @@ uses the GitHub API and the workflow run context.
 
 ### Note
 
-Thank you for your interest in this GitHub action, however, right now we are not taking contributions. 
+Thank you for your interest in this GitHub action, however, right now we are not taking contributions.
 
 We continue to focus our resources on strategic areas that help our customers be successful while making developers' lives easier. While GitHub Actions remains a key part of this vision, we are allocating resources towards other areas of Actions and are not taking contributions to this repository at this time. The GitHub public roadmap is the best place to follow along for any updates on features we’re working on and what stage they’re in.
 
@@ -25,7 +25,7 @@ We will still provide security updates for this project and fix major breaking c
 
 You are welcome to still raise bugs in this repo.
 
-### This action 
+### This action
 
 To use this action, provide an input named `script` that contains the body of an asynchronous JavaScript function call.
 The following arguments will be provided:
@@ -38,6 +38,7 @@ The following arguments will be provided:
 - `glob` A reference to the [@actions/glob](https://github.com/actions/toolkit/tree/main/packages/glob) package
 - `io` A reference to the [@actions/io](https://github.com/actions/toolkit/tree/main/packages/io) package
 - `exec` A reference to the [@actions/exec](https://github.com/actions/toolkit/tree/main/packages/exec) package
+- `getOctokit` A factory function to create additional authenticated Octokit clients with different tokens (see [Creating additional clients](#creating-additional-clients-with-getoctokit))
 - `require` A proxy wrapper around the normal Node.js `require` to enable
   requiring relative paths (relative to the current working directory) and
   requiring npm packages installed in the current working directory. If for
@@ -53,6 +54,21 @@ documentation.
 
 ## Breaking Changes
 
+### V9
+
+Version 9 of this action upgrades to `@actions/github` v9, which brings the latest Octokit types and features.
+
+**New features:**
+
+- **`getOctokit` factory function** — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See [Creating additional clients with `getOctokit`](#creating-additional-clients-with-getoctokit) for details and examples.
+- **Orchestration ID in user-agent** — The `ACTIONS_ORCHESTRATION_ID` environment variable is automatically appended to the user-agent string for request tracing.
+
+**Breaking changes:**
+
+- **`require('@actions/github')` no longer works in scripts.** The upgrade to `@actions/github` v9 (ESM-only) means `require('@actions/github')` will fail at runtime. If you previously used patterns like `const { getOctokit } = require('@actions/github')` to create secondary clients, use the new injected `getOctokit` function instead — it's available directly in the script context with no imports needed.
+- `getOctokit` is now an injected function parameter. Scripts that declare `const getOctokit = ...` or `let getOctokit = ...` will get a `SyntaxError` because JavaScript does not allow `const`/`let` redeclaration of function parameters. Use the injected `getOctokit` directly, or use `var getOctokit = ...` if you need to redeclare it.
+- If your script accesses other `@actions/github` internals beyond the standard `github`/`octokit` client, you may need to update those references for v9 compatibility.
+
 ### V8
 
 Version 8 of this action updated the runtime to Node 24 - https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runs-for-javascript-actions
@@ -90,16 +106,16 @@ See [development.md](/docs/development.md).
 ## Passing inputs to the script
 
 Actions expressions are evaluated before the `script` is passed to the action, so the result of any expressions
-*will be evaluated as JavaScript code*.
+_will be evaluated as JavaScript code_.
 
-It's highly recommended to *not* evaluate expressions directly in the `script` to avoid
+It's highly recommended to _not_ evaluate expressions directly in the `script` to avoid
 [script injections](https://docs.github.com/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections)
 and potential `SyntaxError`s when the expression is not valid JavaScript code (particularly when it comes to improperly escaped strings).
 
 To pass inputs, set `env` vars on the action step and reference them in your script with `process.env`:
 
 ```yaml
-- uses: actions/github-script@v8
+- uses: actions/github-script@v9
   env:
     TITLE: ${{ github.event.pull_request.title }}
   with:
@@ -118,7 +134,7 @@ The return value of the script will be in the step's outputs under the
 "result" key.
 
 ```yaml
-- uses: actions/github-script@v8
+- uses: actions/github-script@v9
   id: set-result
   with:
     script: return "Hello!"
@@ -137,7 +153,7 @@ output of a github-script step. For some workflows, string encoding is preferred
 `result-encoding` input:
 
 ```yaml
-- uses: actions/github-script@v8
+- uses: actions/github-script@v9
   id: my-script
   with:
     result-encoding: string
@@ -149,7 +165,7 @@ output of a github-script step. For some workflows, string encoding is preferred
 By default, requests made with the `github` instance will not be retried. You can configure this with the `retries` option:
 
 ```yaml
-- uses: actions/github-script@v8
+- uses: actions/github-script@v9
   id: my-script
   with:
     result-encoding: string
@@ -167,7 +183,7 @@ In this example, request failures from `github.rest.issues.get()` will be retrie
 You can also configure which status codes should be exempt from retries via the `retry-exempt-status-codes` option:
 
 ```yaml
-- uses: actions/github-script@v8
+- uses: actions/github-script@v9
   id: my-script
   with:
     result-encoding: string
@@ -196,7 +212,7 @@ By default, github-script will use the token provided to your workflow.
 
 ```yaml
 - name: View context attributes
-  uses: actions/github-script@v8
+  uses: actions/github-script@v9
   with:
     script: console.log(context)
 ```
@@ -212,7 +228,7 @@ jobs:
   comment:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@v8
+      - uses: actions/github-script@v9
         with:
           script: |
             github.rest.issues.createComment({
@@ -234,7 +250,7 @@ jobs:
   apply-label:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@v8
+      - uses: actions/github-script@v9
         with:
           script: |
             github.rest.issues.addLabels({
@@ -256,7 +272,7 @@ jobs:
   welcome:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@v8
+      - uses: actions/github-script@v9
         with:
           script: |
             // Get a list of all issues created by the PR opener
@@ -301,7 +317,7 @@ jobs:
   diff:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@v8
+      - uses: actions/github-script@v9
         with:
           script: |
             const diff_url = context.payload.pull_request.diff_url
@@ -325,7 +341,7 @@ jobs:
   list-issues:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@v8
+      - uses: actions/github-script@v9
         with:
           script: |
             const query = `query($owner:String!, $name:String!, $label:String!) {
@@ -359,7 +375,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/github-script@v8
+      - uses: actions/github-script@v9
         with:
           script: |
             const script = require('./path/to/script.js')
@@ -397,7 +413,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/github-script@v8
+      - uses: actions/github-script@v9
         env:
           SHA: '${{env.parentSHA}}'
         with:
@@ -441,7 +457,7 @@ jobs:
       - run: npm ci
       # or one-off:
       - run: npm install execa
-      - uses: actions/github-script@v8
+      - uses: actions/github-script@v9
         with:
           script: |
             const execa = require('execa')
@@ -471,7 +487,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/github-script@v8
+      - uses: actions/github-script@v9
         with:
           script: |
             const { default: printStuff } = await import('${{ github.workspace }}/src/print-stuff.js')
@@ -483,21 +499,22 @@ jobs:
 
 If you want type support for your scripts, you could use the command below to install the
 `@actions/github-script` type declaration.
+
 ```sh
 $ npm i -D @actions/github-script@github:actions/github-script
 ```
 
 And then add the `jsDoc` declaration to your script like this:
+
 ```js
 // @ts-check
 /** @param {import('@actions/github-script').AsyncFunctionArguments} AsyncFunctionArguments */
-export default async ({ core, context }) => {
-  core.debug("Running something at the moment");
-  return context.actor;
-};
+export default async ({core, context}) => {
+  core.debug('Running something at the moment')
+  return context.actor
+}
 ```
 
-
 ### Using a separate GitHub token
 
 The `GITHUB_TOKEN` used by default is scoped to the current repository, see [Authentication in a workflow](https://docs.github.com/actions/reference/authentication-in-a-workflow).
@@ -506,25 +523,89 @@ If you need access to a different repository or an API that the `GITHUB_TOKEN` d
 
 [Learn more about creating and using encrypted secrets](https://docs.github.com/actions/reference/encrypted-secrets)
 
-```yaml
-on:
-  issues:
-    types: [opened]
+### Creating additional clients with `getOctokit`
 
-jobs:
-  apply-label:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/github-script@v8
-        with:
-          github-token: ${{ secrets.MY_PAT }}
-          script: |
-            github.rest.issues.addLabels({
-              issue_number: context.issue.number,
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              labels: ['Triage']
-            })
+The `getOctokit` function is available in the script context and lets you create additional authenticated Octokit clients — useful when you need to interact with the GitHub API using a different token than the one provided to the action (e.g. a GitHub App installation token, a PAT for cross-org access, or a fine-grained token with different permissions).
+
+```js
+getOctokit(token)
+getOctokit(token, opts)
+```
+
+**Parameters:**
+
+| Name    | Type     | Description                                                                             |
+| ------- | -------- | --------------------------------------------------------------------------------------- |
+| `token` | `string` | **Required.** A GitHub token (PAT, GitHub App token, etc.)                              |
+| `opts`  | `object` | Optional. Octokit constructor options (e.g. `userAgent`, `baseUrl`, `request`, `retry`) |
+
+The returned client is fully configured with the same plugins as `github` (retry, request-log, proxy support) — you don't need to set those up yourself.
+
+**Option merging behavior:** `request` and `retry` are deep-merged with the action's defaults, so you can override individual fields (e.g. `{request: {timeout: 5000}}`) without losing the inherited retry count or proxy settings. All other top-level options (like `baseUrl` or `userAgent`) are replaced outright if you provide them.
+
+> **Note:** `getOctokit` is injected as a function parameter (like `github`, `context`, `core`, etc.). You cannot redeclare it with `const` or `let` — this will cause a `SyntaxError`. Use `getOctokit` directly, or use `var` if you need to redeclare it. See [V9 breaking changes](#v9) for details.
+
+#### Basic usage — one primary token, one secondary token
+
+```yaml
+- uses: actions/github-script@v9
+  env:
+    APP_TOKEN: ${{ secrets.MY_APP_TOKEN }}
+  with:
+    github-token: ${{ secrets.GITHUB_TOKEN }}
+    script: |
+      // `github` uses GITHUB_TOKEN (scoped to this repo)
+      await github.rest.issues.addLabels({
+        issue_number: context.issue.number,
+        owner: context.repo.owner,
+        repo: context.repo.repo,
+        labels: ['triage']
+      })
+
+      // `getOctokit` creates a second client with a different token
+      const appOctokit = getOctokit(process.env.APP_TOKEN)
+      await appOctokit.rest.repos.createDispatchEvent({
+        owner: 'my-org',
+        repo: 'another-repo',
+        event_type: 'trigger-deploy'
+      })
+```
+
+#### Multiple clients for cross-org workflows
+
+```yaml
+- uses: actions/github-script@v9
+  env:
+    ORG_A_TOKEN: ${{ secrets.ORG_A_PAT }}
+    ORG_B_TOKEN: ${{ secrets.ORG_B_PAT }}
+  with:
+    script: |
+      const orgA = getOctokit(process.env.ORG_A_TOKEN)
+      const orgB = getOctokit(process.env.ORG_B_TOKEN)
+
+      const [repoA, repoB] = await Promise.all([
+        orgA.rest.repos.get({ owner: 'org-a', repo: 'service' }),
+        orgB.rest.repos.get({ owner: 'org-b', repo: 'service' })
+      ])
+
+      console.log(`Org A: ${repoA.data.full_name}`)
+      console.log(`Org B: ${repoB.data.full_name}`)
+```
+
+#### Custom options
+
+```yaml
+- uses: actions/github-script@v9
+  env:
+    GHES_TOKEN: ${{ secrets.GHES_PAT }}
+  with:
+    script: |
+      const ghes = getOctokit(process.env.GHES_TOKEN, {
+        baseUrl: 'https://github.example.com/api/v3'
+      })
+
+      const { data } = await ghes.rest.repos.listForOrg({ org: 'internal' })
+      console.log(`Found ${data.length} repos on GHES`)
 ```
 
 ### Using exec package
@@ -539,7 +620,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/github-script@v8
+      - uses: actions/github-script@v9
         with:
           script: |
             const exitCode = await exec.exec('echo', ['hello'])
@@ -557,7 +638,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/github-script@v8
+      - uses: actions/github-script@v9
         with:
           script: |
             const {
@@ -567,4 +648,4 @@ jobs:
             } = await exec.getExecOutput('echo', ['hello']);
 
             console.log(exitCode, stdout, stderr)
-```      
+```

__test__/async-function.test.ts

@@ -8,6 +8,94 @@ describe('callAsyncFunction', () => {
     expect(result).toEqual('bar')
   })
 
+  test('passes getOctokit through the script context', async () => {
+    const getOctokit = jest.fn().mockReturnValue('secondary-client')
+
+    const result = await callAsyncFunction(
+      {getOctokit} as any,
+      "return getOctokit('token')"
+    )
+
+    expect(getOctokit).toHaveBeenCalledWith('token')
+    expect(result).toEqual('secondary-client')
+  })
+
+  test('getOctokit creates client independent from github', async () => {
+    const github = {rest: {issues: 'primary'}}
+    const getOctokit = jest.fn().mockReturnValue({rest: {issues: 'secondary'}})
+
+    const result = await callAsyncFunction(
+      {github, getOctokit} as any,
+      `
+        const secondary = getOctokit('other-token')
+        return {
+          primary: github.rest.issues,
+          secondary: secondary.rest.issues,
+          different: github !== secondary
+        }
+      `
+    )
+
+    expect(result).toEqual({
+      primary: 'primary',
+      secondary: 'secondary',
+      different: true
+    })
+    expect(getOctokit).toHaveBeenCalledWith('other-token')
+  })
+
+  test('getOctokit passes options through', async () => {
+    const getOctokit = jest.fn().mockReturnValue('client-with-opts')
+
+    const result = await callAsyncFunction(
+      {getOctokit} as any,
+      `return getOctokit('my-token', { baseUrl: 'https://ghes.example.com/api/v3' })`
+    )
+
+    expect(getOctokit).toHaveBeenCalledWith('my-token', {
+      baseUrl: 'https://ghes.example.com/api/v3'
+    })
+    expect(result).toEqual('client-with-opts')
+  })
+
+  test('getOctokit supports plugins', async () => {
+    const getOctokit = jest.fn().mockReturnValue('client-with-plugins')
+
+    const result = await callAsyncFunction(
+      {getOctokit} as any,
+      `return getOctokit('my-token', { previews: ['v3'] }, 'pluginA', 'pluginB')`
+    )
+
+    expect(getOctokit).toHaveBeenCalledWith(
+      'my-token',
+      {previews: ['v3']},
+      'pluginA',
+      'pluginB'
+    )
+    expect(result).toEqual('client-with-plugins')
+  })
+
+  test('multiple getOctokit calls produce independent clients', async () => {
+    const getOctokit = jest
+      .fn()
+      .mockReturnValueOnce({id: 'client-a'})
+      .mockReturnValueOnce({id: 'client-b'})
+
+    const result = await callAsyncFunction(
+      {getOctokit} as any,
+      `
+        const a = getOctokit('token-a')
+        const b = getOctokit('token-b')
+        return { a: a.id, b: b.id, different: a !== b }
+      `
+    )
+
+    expect(getOctokit).toHaveBeenCalledTimes(2)
+    expect(getOctokit).toHaveBeenNthCalledWith(1, 'token-a')
+    expect(getOctokit).toHaveBeenNthCalledWith(2, 'token-b')
+    expect(result).toEqual({a: 'client-a', b: 'client-b', different: true})
+  })
+
   test('throws on ReferenceError', async () => {
     expect.assertions(1)
 
@@ -25,4 +113,22 @@ describe('callAsyncFunction', () => {
   test('can access console', async () => {
     await callAsyncFunction({} as any, 'console')
   })
+
+  test('injected names are accessible when not redeclared', async () => {
+    const getOctokit = jest.fn().mockReturnValue('from-injected')
+
+    const result = await callAsyncFunction(
+      {getOctokit} as any,
+      `return getOctokit('token')`
+    )
+
+    expect(result).toEqual('from-injected')
+    expect(getOctokit).toHaveBeenCalledWith('token')
+  })
+
+  test('syntax errors in user code still throw', () => {
+    expect(() => callAsyncFunction({} as any, 'const x = {')).toThrow(
+      SyntaxError
+    )
+  })
 })

__test__/create-configured-getoctokit.test.ts

@@ -0,0 +1,288 @@
+/* eslint-disable @typescript-eslint/no-explicit-any */
+
+import {createConfiguredGetOctokit} from '../src/create-configured-getoctokit'
+
+describe('createConfiguredGetOctokit', () => {
+  const mockRetryPlugin = jest.fn()
+  const mockRequestLogPlugin = jest.fn()
+
+  function makeMockGetOctokit() {
+    return jest.fn().mockReturnValue('mock-client')
+  }
+
+  test('passes token and merged defaults to underlying getOctokit', () => {
+    const raw = makeMockGetOctokit()
+    const defaults = {
+      userAgent: 'actions/github-script actions_orchestration_id/abc',
+      retry: {enabled: true},
+      request: {retries: 3}
+    }
+
+    const wrapped = createConfiguredGetOctokit(
+      raw as any,
+      defaults,
+      mockRetryPlugin,
+      mockRequestLogPlugin
+    )
+    wrapped('my-token' as any)
+
+    expect(raw).toHaveBeenCalledWith(
+      'my-token',
+      expect.objectContaining({
+        userAgent: 'actions/github-script actions_orchestration_id/abc',
+        retry: {enabled: true},
+        request: {retries: 3}
+      }),
+      mockRetryPlugin,
+      mockRequestLogPlugin
+    )
+  })
+
+  test('user options override top-level defaults', () => {
+    const raw = makeMockGetOctokit()
+    const defaults = {
+      userAgent: 'default-agent',
+      previews: ['v3']
+    }
+
+    const wrapped = createConfiguredGetOctokit(raw as any, defaults)
+    wrapped('tok' as any, {userAgent: 'custom-agent'} as any)
+
+    expect(raw).toHaveBeenCalledWith(
+      'tok',
+      expect.objectContaining({userAgent: 'custom-agent', previews: ['v3']})
+    )
+  })
+
+  test('deep-merges request so partial overrides preserve retries', () => {
+    const raw = makeMockGetOctokit()
+    const defaults = {
+      request: {retries: 3, agent: 'proxy-agent', fetch: 'proxy-fetch'}
+    }
+
+    const wrapped = createConfiguredGetOctokit(raw as any, defaults)
+    wrapped('tok' as any, {request: {timeout: 5000}} as any)
+
+    expect(raw).toHaveBeenCalledWith(
+      'tok',
+      expect.objectContaining({
+        request: {
+          retries: 3,
+          agent: 'proxy-agent',
+          fetch: 'proxy-fetch',
+          timeout: 5000
+        }
+      })
+    )
+  })
+
+  test('deep-merges retry so partial overrides preserve existing settings', () => {
+    const raw = makeMockGetOctokit()
+    const defaults = {
+      retry: {enabled: true, retries: 3}
+    }
+
+    const wrapped = createConfiguredGetOctokit(raw as any, defaults)
+    wrapped('tok' as any, {retry: {retries: 5}} as any)
+
+    expect(raw).toHaveBeenCalledWith(
+      'tok',
+      expect.objectContaining({
+        retry: {enabled: true, retries: 5}
+      })
+    )
+  })
+
+  test('user can override request.retries explicitly', () => {
+    const raw = makeMockGetOctokit()
+    const defaults = {request: {retries: 3}}
+
+    const wrapped = createConfiguredGetOctokit(raw as any, defaults)
+    wrapped('tok' as any, {request: {retries: 0}} as any)
+
+    expect(raw).toHaveBeenCalledWith(
+      'tok',
+      expect.objectContaining({request: {retries: 0}})
+    )
+  })
+
+  test('user plugins are appended after default plugins', () => {
+    const raw = makeMockGetOctokit()
+    const customPlugin = jest.fn()
+
+    const wrapped = createConfiguredGetOctokit(
+      raw as any,
+      {},
+      mockRetryPlugin,
+      mockRequestLogPlugin
+    )
+    wrapped('tok' as any, {} as any, customPlugin as any)
+
+    expect(raw).toHaveBeenCalledWith(
+      'tok',
+      expect.any(Object),
+      mockRetryPlugin,
+      mockRequestLogPlugin,
+      customPlugin
+    )
+  })
+
+  test('duplicate plugins are deduplicated', () => {
+    const raw = makeMockGetOctokit()
+
+    const wrapped = createConfiguredGetOctokit(
+      raw as any,
+      {},
+      mockRetryPlugin,
+      mockRequestLogPlugin
+    )
+    // User passes retry again — should not duplicate
+    wrapped('tok' as any, {} as any, mockRetryPlugin as any)
+
+    expect(raw).toHaveBeenCalledWith(
+      'tok',
+      expect.any(Object),
+      mockRetryPlugin,
+      mockRequestLogPlugin
+    )
+  })
+
+  test('applies defaults when no user options provided', () => {
+    const raw = makeMockGetOctokit()
+    const defaults = {
+      userAgent: 'actions/github-script',
+      retry: {enabled: true},
+      request: {retries: 3}
+    }
+
+    const wrapped = createConfiguredGetOctokit(
+      raw as any,
+      defaults,
+      mockRetryPlugin
+    )
+    wrapped('tok' as any)
+
+    expect(raw).toHaveBeenCalledWith(
+      'tok',
+      {
+        userAgent: 'actions/github-script',
+        retry: {enabled: true},
+        request: {retries: 3}
+      },
+      mockRetryPlugin
+    )
+  })
+
+  test('baseUrl: undefined from user does not clobber default', () => {
+    const raw = makeMockGetOctokit()
+    const defaults = {baseUrl: 'https://ghes.example.com/api/v3'}
+
+    const wrapped = createConfiguredGetOctokit(raw as any, defaults)
+    wrapped('tok' as any, {baseUrl: undefined} as any)
+
+    const calledOpts = raw.mock.calls[0][1]
+    expect(calledOpts.baseUrl).toBe('https://ghes.example.com/api/v3')
+  })
+
+  test('undefined values in nested request are stripped', () => {
+    const raw = makeMockGetOctokit()
+    const defaults = {request: {retries: 3, agent: 'proxy'}}
+
+    const wrapped = createConfiguredGetOctokit(raw as any, defaults)
+    wrapped('tok' as any, {request: {retries: undefined, timeout: 5000}} as any)
+
+    const calledOpts = raw.mock.calls[0][1]
+    expect(calledOpts.request).toEqual({
+      retries: 3,
+      agent: 'proxy',
+      timeout: 5000
+    })
+  })
+
+  test('undefined values in nested retry are stripped', () => {
+    const raw = makeMockGetOctokit()
+    const defaults = {retry: {enabled: true, retries: 3}}
+
+    const wrapped = createConfiguredGetOctokit(raw as any, defaults)
+    wrapped('tok' as any, {retry: {enabled: undefined, retries: 5}} as any)
+
+    const calledOpts = raw.mock.calls[0][1]
+    expect(calledOpts.retry).toEqual({enabled: true, retries: 5})
+  })
+
+  test('each call creates an independent client', () => {
+    const raw = jest
+      .fn()
+      .mockReturnValueOnce('client-a')
+      .mockReturnValueOnce('client-b')
+
+    const wrapped = createConfiguredGetOctokit(raw as any, {})
+    const a = wrapped('token-a' as any)
+    const b = wrapped('token-b' as any)
+
+    expect(a).toBe('client-a')
+    expect(b).toBe('client-b')
+    expect(raw).toHaveBeenCalledTimes(2)
+  })
+
+  test('does not mutate defaultOptions between calls', () => {
+    const raw = makeMockGetOctokit()
+    const defaults = {
+      request: {retries: 3},
+      retry: {enabled: true}
+    }
+    const originalDefaults = JSON.parse(JSON.stringify(defaults))
+
+    const wrapped = createConfiguredGetOctokit(raw as any, defaults)
+    wrapped(
+      'tok' as any,
+      {request: {timeout: 5000}, retry: {retries: 10}} as any
+    )
+    wrapped('tok' as any, {request: {timeout: 9000}} as any)
+
+    expect(defaults).toEqual(originalDefaults)
+  })
+
+  test('undefined values in defaults are stripped (e.g. log: undefined)', () => {
+    const raw = makeMockGetOctokit()
+    const defaults = {
+      userAgent: 'actions/github-script',
+      log: undefined,
+      previews: undefined,
+      retry: {enabled: true}
+    }
+
+    const wrapped = createConfiguredGetOctokit(raw as any, defaults)
+    wrapped('tok' as any)
+
+    const calledOpts = raw.mock.calls[0][1]
+    expect(calledOpts.userAgent).toBe('actions/github-script')
+    expect(calledOpts.retry).toEqual({enabled: true})
+    // undefined defaults should be stripped, not passed through
+    expect('log' in calledOpts).toBe(false)
+    expect('previews' in calledOpts).toBe(false)
+  })
+
+  test('falsy-but-valid values are preserved, only undefined is stripped', () => {
+    const raw = makeMockGetOctokit()
+    const defaults = {baseUrl: 'https://ghes.example.com/api/v3'}
+
+    const wrapped = createConfiguredGetOctokit(raw as any, defaults)
+    wrapped(
+      'tok' as any,
+      {
+        log: null,
+        retries: 0,
+        debug: false,
+        userAgent: ''
+      } as any
+    )
+
+    const calledOpts = raw.mock.calls[0][1]
+    expect(calledOpts.log).toBeNull()
+    expect(calledOpts.retries).toBe(0)
+    expect(calledOpts.debug).toBe(false)
+    expect(calledOpts.userAgent).toBe('')
+    expect(calledOpts.baseUrl).toBe('https://ghes.example.com/api/v3')
+  })
+})

__test__/getoctokit-integration.test.ts

@@ -0,0 +1,102 @@
+/* eslint-disable @typescript-eslint/no-explicit-any */
+
+import {callAsyncFunction} from '../src/async-function'
+
+// Create a mock getOctokit that returns Octokit-like objects.
+// Real @actions/github integration is tested in the CI workflow
+// (integration.yml test-get-octokit job). Here we verify the
+// script context wiring — getOctokit is passed through and
+// callable from user scripts.
+function mockGetOctokit(token: string, options?: any) {
+  return {
+    _token: token,
+    _options: options,
+    rest: {
+      issues: {get: async () => ({data: {id: 1}})},
+      pulls: {get: async () => ({data: {id: 2}})}
+    },
+    graphql: async () => ({}),
+    request: async () => ({})
+  }
+}
+
+describe('getOctokit integration via callAsyncFunction', () => {
+  test('getOctokit creates a functional client in script scope', async () => {
+    const result = await callAsyncFunction(
+      {getOctokit: mockGetOctokit} as any,
+      `
+        const client = getOctokit('fake-token-for-test')
+        return {
+          hasRest: typeof client.rest === 'object',
+          hasGraphql: typeof client.graphql === 'function',
+          hasRequest: typeof client.request === 'function',
+          hasIssues: typeof client.rest.issues === 'object',
+          hasPulls: typeof client.rest.pulls === 'object'
+        }
+      `
+    )
+
+    expect(result).toEqual({
+      hasRest: true,
+      hasGraphql: true,
+      hasRequest: true,
+      hasIssues: true,
+      hasPulls: true
+    })
+  })
+
+  test('secondary client is independent from primary github client', async () => {
+    const primary = mockGetOctokit('primary-token')
+
+    const result = await callAsyncFunction(
+      {github: primary, getOctokit: mockGetOctokit} as any,
+      `
+        const secondary = getOctokit('secondary-token')
+        return {
+          bothHaveRest: typeof github.rest === 'object' && typeof secondary.rest === 'object',
+          areDistinct: github !== secondary
+        }
+      `
+    )
+
+    expect(result).toEqual({
+      bothHaveRest: true,
+      areDistinct: true
+    })
+  })
+
+  test('getOctokit accepts options for GHES base URL', async () => {
+    const result = await callAsyncFunction(
+      {getOctokit: mockGetOctokit} as any,
+      `
+        const client = getOctokit('fake-token', {
+          baseUrl: 'https://ghes.example.com/api/v3'
+        })
+        return typeof client.rest === 'object'
+      `
+    )
+
+    expect(result).toBe(true)
+  })
+
+  test('multiple getOctokit calls produce independent clients with different tokens', async () => {
+    const result = await callAsyncFunction(
+      {getOctokit: mockGetOctokit} as any,
+      `
+        const clientA = getOctokit('token-a')
+        const clientB = getOctokit('token-b')
+        return {
+          aHasRest: typeof clientA.rest === 'object',
+          bHasRest: typeof clientB.rest === 'object',
+          areDistinct: clientA !== clientB
+        }
+      `
+    )
+
+    expect(result).toEqual({
+      aHasRest: true,
+      bHasRest: true,
+      areDistinct: true
+    })
+  })
+})

package-lock.json

@@ -1,22 +1,22 @@
 {
   "name": "@actions/github-script",
-  "version": "7.0.1",
+  "version": "9.0.0",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "@actions/github-script",
-      "version": "7.0.1",
+      "version": "9.0.0",
       "license": "MIT",
       "dependencies": {
         "@actions/core": "^1.10.1",
         "@actions/exec": "^1.1.1",
-        "@actions/github": "^6.0.0",
+        "@actions/github": "^9.0.0",
         "@actions/glob": "^0.4.0",
         "@actions/io": "^1.1.3",
-        "@octokit/core": "^5.0.1",
-        "@octokit/plugin-request-log": "^4.0.0",
-        "@octokit/plugin-retry": "^6.0.1",
+        "@octokit/core": "^7.0.0",
+        "@octokit/plugin-request-log": "^6.0.0",
+        "@octokit/plugin-retry": "^8.0.0",
         "@types/node": "^24.1.0"
       },
       "devDependencies": {
@@ -65,14 +65,37 @@
       }
     },
     "node_modules/@actions/github": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/@actions/github/-/github-6.0.0.tgz",
-      "integrity": "sha512-alScpSVnYmjNEXboZjarjukQEzgCRmjMv6Xj47fsdnqGS73bjJNDpiiXmp8jr0UZLdUB6d9jW63IcmddUP+l0g==",
+      "version": "9.1.0",
+      "resolved": "https://registry.npmjs.org/@actions/github/-/github-9.1.0.tgz",
+      "integrity": "sha512-u0hDGQeCS+7VNoLA8hYG65RLdPLMaPGfka0sZ0up7P0AiShqfX6xcuXNteGkQ7X7Tod7AMNwHd4p7DS63i8zzA==",
+      "license": "MIT",
       "dependencies": {
-        "@actions/http-client": "^2.2.0",
-        "@octokit/core": "^5.0.1",
-        "@octokit/plugin-paginate-rest": "^9.0.0",
-        "@octokit/plugin-rest-endpoint-methods": "^10.0.0"
+        "@actions/http-client": "^3.0.2",
+        "@octokit/core": "^7.0.6",
+        "@octokit/plugin-paginate-rest": "^14.0.0",
+        "@octokit/plugin-rest-endpoint-methods": "^17.0.0",
+        "@octokit/request": "^10.0.7",
+        "@octokit/request-error": "^7.1.0",
+        "undici": "^6.23.0"
+      }
+    },
+    "node_modules/@actions/github/node_modules/@actions/http-client": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.2.tgz",
+      "integrity": "sha512-JP38FYYpyqvUsz+Igqlc/JG6YO9PaKuvqjM3iGvaLqFnJ7TFmcLyy2IDrY0bI0qCQug8E9K+elv5ZNfw62ZJzA==",
+      "license": "MIT",
+      "dependencies": {
+        "tunnel": "^0.0.6",
+        "undici": "^6.23.0"
+      }
+    },
+    "node_modules/@actions/github/node_modules/undici": {
+      "version": "6.24.1",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.24.1.tgz",
+      "integrity": "sha512-sC+b0tB1whOCzbtlx20fx3WgCXwkW627p4EA9uM+/tNNPkSS+eSEld6pAs9nDv7WbY1UUljBMYPtu9BCOrCWKA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.17"
       }
     },
     "node_modules/@actions/glob": {
@@ -1268,202 +1291,160 @@
       }
     },
     "node_modules/@octokit/auth-token": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-4.0.0.tgz",
-      "integrity": "sha512-tY/msAuJo6ARbK6SPIxZrPBms3xPbfwBrulZe0Wtr/DIY9lje2HeV1uoebShn6mx7SjCHif6EjMvoREj+gZ+SA==",
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-6.0.0.tgz",
+      "integrity": "sha512-P4YJBPdPSpWTQ1NU4XYdvHvXJJDxM6YwpS0FZHRgP7YFkdVxsWcpWGy/NVqlAA7PcPCnMacXlRm1y2PFZRWL/w==",
+      "license": "MIT",
       "engines": {
-        "node": ">= 18"
+        "node": ">= 20"
       }
     },
     "node_modules/@octokit/core": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/@octokit/core/-/core-5.0.1.tgz",
-      "integrity": "sha512-lyeeeZyESFo+ffI801SaBKmCfsvarO+dgV8/0gD8u1d87clbEdWsP5yC+dSj3zLhb2eIf5SJrn6vDz9AheETHw==",
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/@octokit/core/-/core-7.0.6.tgz",
+      "integrity": "sha512-DhGl4xMVFGVIyMwswXeyzdL4uXD5OGILGX5N8Y+f6W7LhC1Ze2poSNrkF/fedpVDHEEZ+PHFW0vL14I+mm8K3Q==",
+      "license": "MIT",
       "dependencies": {
-        "@octokit/auth-token": "^4.0.0",
-        "@octokit/graphql": "^7.0.0",
-        "@octokit/request": "^8.0.2",
-        "@octokit/request-error": "^5.0.0",
-        "@octokit/types": "^12.0.0",
-        "before-after-hook": "^2.2.0",
-        "universal-user-agent": "^6.0.0"
+        "@octokit/auth-token": "^6.0.0",
+        "@octokit/graphql": "^9.0.3",
+        "@octokit/request": "^10.0.6",
+        "@octokit/request-error": "^7.0.2",
+        "@octokit/types": "^16.0.0",
+        "before-after-hook": "^4.0.0",
+        "universal-user-agent": "^7.0.0"
       },
       "engines": {
-        "node": ">= 18"
+        "node": ">= 20"
       }
     },
     "node_modules/@octokit/endpoint": {
-      "version": "9.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-9.0.0.tgz",
-      "integrity": "sha512-szrQhiqJ88gghWY2Htt8MqUDO6++E/EIXqJ2ZEp5ma3uGS46o7LZAzSLt49myB7rT+Hfw5Y6gO3LmOxGzHijAQ==",
+      "version": "11.0.3",
+      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-11.0.3.tgz",
+      "integrity": "sha512-FWFlNxghg4HrXkD3ifYbS/IdL/mDHjh9QcsNyhQjN8dplUoZbejsdpmuqdA76nxj2xoWPs7p8uX2SNr9rYu0Ag==",
+      "license": "MIT",
       "dependencies": {
-        "@octokit/types": "^11.0.0",
-        "is-plain-object": "^5.0.0",
-        "universal-user-agent": "^6.0.0"
+        "@octokit/types": "^16.0.0",
+        "universal-user-agent": "^7.0.2"
       },
       "engines": {
-        "node": ">= 18"
-      }
-    },
-    "node_modules/@octokit/endpoint/node_modules/@octokit/openapi-types": {
-      "version": "18.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-18.0.0.tgz",
-      "integrity": "sha512-V8GImKs3TeQRxRtXFpG2wl19V7444NIOTDF24AWuIbmNaNYOQMWRbjcGDXV5B+0n887fgDcuMNOmlul+k+oJtw=="
-    },
-    "node_modules/@octokit/endpoint/node_modules/@octokit/types": {
-      "version": "11.1.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-11.1.0.tgz",
-      "integrity": "sha512-Fz0+7GyLm/bHt8fwEqgvRBWwIV1S6wRRyq+V6exRKLVWaKGsuy6H9QFYeBVDV7rK6fO3XwHgQOPxv+cLj2zpXQ==",
-      "dependencies": {
-        "@octokit/openapi-types": "^18.0.0"
+        "node": ">= 20"
       }
     },
     "node_modules/@octokit/graphql": {
-      "version": "7.0.1",
-      "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-7.0.1.tgz",
-      "integrity": "sha512-T5S3oZ1JOE58gom6MIcrgwZXzTaxRnxBso58xhozxHpOqSTgDS6YNeEUvZ/kRvXgPrRz/KHnZhtb7jUMRi9E6w==",
+      "version": "9.0.3",
+      "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-9.0.3.tgz",
+      "integrity": "sha512-grAEuupr/C1rALFnXTv6ZQhFuL1D8G5y8CN04RgrO4FIPMrtm+mcZzFG7dcBm+nq+1ppNixu+Jd78aeJOYxlGA==",
+      "license": "MIT",
       "dependencies": {
-        "@octokit/request": "^8.0.1",
-        "@octokit/types": "^11.0.0",
-        "universal-user-agent": "^6.0.0"
+        "@octokit/request": "^10.0.6",
+        "@octokit/types": "^16.0.0",
+        "universal-user-agent": "^7.0.0"
       },
       "engines": {
-        "node": ">= 18"
-      }
-    },
-    "node_modules/@octokit/graphql/node_modules/@octokit/openapi-types": {
-      "version": "18.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-18.0.0.tgz",
-      "integrity": "sha512-V8GImKs3TeQRxRtXFpG2wl19V7444NIOTDF24AWuIbmNaNYOQMWRbjcGDXV5B+0n887fgDcuMNOmlul+k+oJtw=="
-    },
-    "node_modules/@octokit/graphql/node_modules/@octokit/types": {
-      "version": "11.1.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-11.1.0.tgz",
-      "integrity": "sha512-Fz0+7GyLm/bHt8fwEqgvRBWwIV1S6wRRyq+V6exRKLVWaKGsuy6H9QFYeBVDV7rK6fO3XwHgQOPxv+cLj2zpXQ==",
-      "dependencies": {
-        "@octokit/openapi-types": "^18.0.0"
+        "node": ">= 20"
       }
     },
     "node_modules/@octokit/openapi-types": {
-      "version": "19.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-19.0.0.tgz",
-      "integrity": "sha512-PclQ6JGMTE9iUStpzMkwLCISFn/wDeRjkZFIKALpvJQNBGwDoYYi2fFvuHwssoQ1rXI5mfh6jgTgWuddeUzfWw=="
+      "version": "27.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-27.0.0.tgz",
+      "integrity": "sha512-whrdktVs1h6gtR+09+QsNk2+FO+49j6ga1c55YZudfEG+oKJVvJLQi3zkOm5JjiUXAagWK2tI2kTGKJ2Ys7MGA==",
+      "license": "MIT"
     },
     "node_modules/@octokit/plugin-paginate-rest": {
-      "version": "9.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-9.0.0.tgz",
-      "integrity": "sha512-oIJzCpttmBTlEhBmRvb+b9rlnGpmFgDtZ0bB6nq39qIod6A5DP+7RkVLMOixIgRCYSHDTeayWqmiJ2SZ6xgfdw==",
+      "version": "14.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-14.0.0.tgz",
+      "integrity": "sha512-fNVRE7ufJiAA3XUrha2omTA39M6IXIc6GIZLvlbsm8QOQCYvpq/LkMNGyFlB1d8hTDzsAXa3OKtybdMAYsV/fw==",
+      "license": "MIT",
       "dependencies": {
-        "@octokit/types": "^12.0.0"
+        "@octokit/types": "^16.0.0"
       },
       "engines": {
-        "node": ">= 18"
+        "node": ">= 20"
       },
       "peerDependencies": {
-        "@octokit/core": ">=5"
+        "@octokit/core": ">=6"
       }
     },
     "node_modules/@octokit/plugin-request-log": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-request-log/-/plugin-request-log-4.0.0.tgz",
-      "integrity": "sha512-2uJI1COtYCq8Z4yNSnM231TgH50bRkheQ9+aH8TnZanB6QilOnx8RMD2qsnamSOXtDj0ilxvevf5fGsBhBBzKA==",
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-request-log/-/plugin-request-log-6.0.0.tgz",
+      "integrity": "sha512-UkOzeEN3W91/eBq9sPZNQ7sUBvYCqYbrrD8gTbBuGtHEuycE4/awMXcYvx6sVYo7LypPhmQwwpUe4Yyu4QZN5Q==",
+      "license": "MIT",
       "engines": {
-        "node": ">= 18"
+        "node": ">= 20"
       },
       "peerDependencies": {
-        "@octokit/core": ">=5"
+        "@octokit/core": ">=6"
       }
     },
     "node_modules/@octokit/plugin-rest-endpoint-methods": {
-      "version": "10.0.1",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-10.0.1.tgz",
-      "integrity": "sha512-fgS6HPkPvJiz8CCliewLyym9qAx0RZ/LKh3sATaPfM41y/O2wQ4Z9MrdYeGPVh04wYmHFmWiGlKPC7jWVtZXQA==",
+      "version": "17.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-17.0.0.tgz",
+      "integrity": "sha512-B5yCyIlOJFPqUUeiD0cnBJwWJO8lkJs5d8+ze9QDP6SvfiXSz1BF+91+0MeI1d2yxgOhU/O+CvtiZ9jSkHhFAw==",
+      "license": "MIT",
       "dependencies": {
-        "@octokit/types": "^12.0.0"
+        "@octokit/types": "^16.0.0"
       },
       "engines": {
-        "node": ">= 18"
+        "node": ">= 20"
       },
       "peerDependencies": {
-        "@octokit/core": ">=5"
+        "@octokit/core": ">=6"
       }
     },
     "node_modules/@octokit/plugin-retry": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-retry/-/plugin-retry-6.0.1.tgz",
-      "integrity": "sha512-SKs+Tz9oj0g4p28qkZwl/topGcb0k0qPNX/i7vBKmDsjoeqnVfFUquqrE/O9oJY7+oLzdCtkiWSXLpLjvl6uog==",
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-retry/-/plugin-retry-8.1.0.tgz",
+      "integrity": "sha512-O1FZgXeiGb2sowEr/hYTr6YunGdSAFWnr2fyW39Ah85H8O33ELASQxcvOFF5LE6Tjekcyu2ms4qAzJVhSaJxTw==",
+      "license": "MIT",
       "dependencies": {
-        "@octokit/request-error": "^5.0.0",
-        "@octokit/types": "^12.0.0",
+        "@octokit/request-error": "^7.0.2",
+        "@octokit/types": "^16.0.0",
         "bottleneck": "^2.15.3"
       },
       "engines": {
-        "node": ">= 18"
+        "node": ">= 20"
       },
       "peerDependencies": {
-        "@octokit/core": ">=5"
+        "@octokit/core": ">=7"
       }
     },
     "node_modules/@octokit/request": {
-      "version": "8.1.1",
-      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-8.1.1.tgz",
-      "integrity": "sha512-8N+tdUz4aCqQmXl8FpHYfKG9GelDFd7XGVzyN8rc6WxVlYcfpHECnuRkgquzz+WzvHTK62co5di8gSXnzASZPQ==",
+      "version": "10.0.8",
+      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-10.0.8.tgz",
+      "integrity": "sha512-SJZNwY9pur9Agf7l87ywFi14W+Hd9Jg6Ifivsd33+/bGUQIjNujdFiXII2/qSlN2ybqUHfp5xpekMEjIBTjlSw==",
+      "license": "MIT",
       "dependencies": {
-        "@octokit/endpoint": "^9.0.0",
-        "@octokit/request-error": "^5.0.0",
-        "@octokit/types": "^11.1.0",
-        "is-plain-object": "^5.0.0",
-        "universal-user-agent": "^6.0.0"
+        "@octokit/endpoint": "^11.0.3",
+        "@octokit/request-error": "^7.0.2",
+        "@octokit/types": "^16.0.0",
+        "fast-content-type-parse": "^3.0.0",
+        "json-with-bigint": "^3.5.3",
+        "universal-user-agent": "^7.0.2"
       },
       "engines": {
-        "node": ">= 18"
+        "node": ">= 20"
       }
     },
     "node_modules/@octokit/request-error": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-5.0.0.tgz",
-      "integrity": "sha512-1ue0DH0Lif5iEqT52+Rf/hf0RmGO9NWFjrzmrkArpG9trFfDM/efx00BJHdLGuro4BR/gECxCU2Twf5OKrRFsQ==",
+      "version": "7.1.0",
+      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-7.1.0.tgz",
+      "integrity": "sha512-KMQIfq5sOPpkQYajXHwnhjCC0slzCNScLHs9JafXc4RAJI+9f+jNDlBNaIMTvazOPLgb4BnlhGJOTbnN0wIjPw==",
+      "license": "MIT",
       "dependencies": {
-        "@octokit/types": "^11.0.0",
-        "deprecation": "^2.0.0",
-        "once": "^1.4.0"
+        "@octokit/types": "^16.0.0"
       },
       "engines": {
-        "node": ">= 18"
-      }
-    },
-    "node_modules/@octokit/request-error/node_modules/@octokit/openapi-types": {
-      "version": "18.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-18.0.0.tgz",
-      "integrity": "sha512-V8GImKs3TeQRxRtXFpG2wl19V7444NIOTDF24AWuIbmNaNYOQMWRbjcGDXV5B+0n887fgDcuMNOmlul+k+oJtw=="
-    },
-    "node_modules/@octokit/request-error/node_modules/@octokit/types": {
-      "version": "11.1.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-11.1.0.tgz",
-      "integrity": "sha512-Fz0+7GyLm/bHt8fwEqgvRBWwIV1S6wRRyq+V6exRKLVWaKGsuy6H9QFYeBVDV7rK6fO3XwHgQOPxv+cLj2zpXQ==",
-      "dependencies": {
-        "@octokit/openapi-types": "^18.0.0"
-      }
-    },
-    "node_modules/@octokit/request/node_modules/@octokit/openapi-types": {
-      "version": "18.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-18.0.0.tgz",
-      "integrity": "sha512-V8GImKs3TeQRxRtXFpG2wl19V7444NIOTDF24AWuIbmNaNYOQMWRbjcGDXV5B+0n887fgDcuMNOmlul+k+oJtw=="
-    },
-    "node_modules/@octokit/request/node_modules/@octokit/types": {
-      "version": "11.1.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-11.1.0.tgz",
-      "integrity": "sha512-Fz0+7GyLm/bHt8fwEqgvRBWwIV1S6wRRyq+V6exRKLVWaKGsuy6H9QFYeBVDV7rK6fO3XwHgQOPxv+cLj2zpXQ==",
-      "dependencies": {
-        "@octokit/openapi-types": "^18.0.0"
+        "node": ">= 20"
       }
     },
     "node_modules/@octokit/types": {
-      "version": "12.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-12.0.0.tgz",
-      "integrity": "sha512-EzD434aHTFifGudYAygnFlS1Tl6KhbTynEWELQXIbTY8Msvb5nEqTZIm7sbPEt4mQYLZwu3zPKVdeIrw0g7ovg==",
+      "version": "16.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-16.0.0.tgz",
+      "integrity": "sha512-sKq+9r1Mm4efXW1FCk7hFSeJo4QKreL/tTbR0rz/qx/r1Oa2VV83LTA/H/MuCOX7uCIJmQVRKBcbmWoySjAnSg==",
+      "license": "MIT",
       "dependencies": {
-        "@octokit/openapi-types": "^19.0.0"
+        "@octokit/openapi-types": "^27.0.0"
       }
     },
     "node_modules/@pkgr/utils": {
@@ -2242,9 +2223,10 @@
       "integrity": "sha1-ibTRmasr7kneFk6gK4nORi1xt2c="
     },
     "node_modules/before-after-hook": {
-      "version": "2.2.2",
-      "resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-2.2.2.tgz",
-      "integrity": "sha512-3pZEU3NT5BFUo/AD5ERPWOgQOCZITni6iavr5AUw5AUwQjMlI0kzu5btnyD39AF0gUEsDPwJT+oY1ORBJijPjQ=="
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-4.0.0.tgz",
+      "integrity": "sha512-q6tR3RPqIB1pMiTRMFcZwuG5T8vwp+vUvEG0vuI6B+Rikh5BfPp2fQ82c925FOs+b0lcFQ8CFrL+KbilfZFhOQ==",
+      "license": "Apache-2.0"
     },
     "node_modules/big-integer": {
       "version": "1.6.51",
@@ -2914,11 +2896,6 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/deprecation": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/deprecation/-/deprecation-2.3.1.tgz",
-      "integrity": "sha512-xmHIy4F3scKVwMsQ4WnVaS8bHOx0DmVwRywosKhaILI0ywMDWPtBSku2HNxRvF7jtwDRsoEwYQSfbxj8b7RlJQ=="
-    },
     "node_modules/detect-newline": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/detect-newline/-/detect-newline-3.1.0.tgz",
@@ -3567,6 +3544,22 @@
         "node": "^14.15.0 || ^16.10.0 || >=18.0.0"
       }
     },
+    "node_modules/fast-content-type-parse": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/fast-content-type-parse/-/fast-content-type-parse-3.0.0.tgz",
+      "integrity": "sha512-ZvLdcY8P+N8mGQJahJV5G4U88CSvT1rP8ApL6uETe88MBXrBHAkZlSEySdUlyztF7ccb+Znos3TFqaepHxdhBg==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/fast-deep-equal": {
       "version": "3.1.3",
       "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
@@ -4347,14 +4340,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/is-plain-object": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/is-plain-object/-/is-plain-object-5.0.0.tgz",
-      "integrity": "sha512-VRSzKkbMm5jMDoKLbltAkFQ5Qr7VDiTFGXxYFXXowVj387GeGNOCsOH6Msy00SGZ3Fp84b1Naa1psqgcCIEP5Q==",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
     "node_modules/is-regex": {
       "version": "1.1.4",
       "resolved": "https://registry.npmjs.org/is-regex/-/is-regex-1.1.4.tgz",
@@ -5558,6 +5543,12 @@
       "integrity": "sha1-nbe1lJatPzz+8wp1FC0tkwrXJlE=",
       "dev": true
     },
+    "node_modules/json-with-bigint": {
+      "version": "3.5.8",
+      "resolved": "https://registry.npmjs.org/json-with-bigint/-/json-with-bigint-3.5.8.tgz",
+      "integrity": "sha512-eq/4KP6K34kwa7TcFdtvnftvHCD9KvHOGGICWwMFc4dOOKF5t4iYqnfLK8otCRCRv06FXOzGGyqE8h8ElMvvdw==",
+      "license": "MIT"
+    },
     "node_modules/json5": {
       "version": "2.2.3",
       "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
@@ -5946,6 +5937,7 @@
       "version": "1.4.0",
       "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
       "integrity": "sha1-WDsap3WWHUsROsF9nFC6753Xa9E=",
+      "dev": true,
       "dependencies": {
         "wrappy": "1"
       }
@@ -7120,9 +7112,10 @@
       "license": "MIT"
     },
     "node_modules/universal-user-agent": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-6.0.0.tgz",
-      "integrity": "sha512-isyNax3wXoKaulPDZWHQqbmIx1k2tb9fb3GGDBRxCscfYV2Ch7WxPArBsFEG8s/safwXTT7H4QGhaIkTp9447w=="
+      "version": "7.0.3",
+      "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.3.tgz",
+      "integrity": "sha512-TmnEAEAsBJVZM/AADELsK76llnwcf9vMKuPz8JflO1frO8Lchitr0fNaN9d+Ap0BjKtqWqd/J17qeDnXh8CL2A==",
+      "license": "ISC"
     },
     "node_modules/untildify": {
       "version": "4.0.0",
@@ -7280,7 +7273,8 @@
     "node_modules/wrappy": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
-      "integrity": "sha1-tSQ9jz7BqjXxNkYFvA0QNuMKtp8="
+      "integrity": "sha1-tSQ9jz7BqjXxNkYFvA0QNuMKtp8=",
+      "dev": true
     },
     "node_modules/write-file-atomic": {
       "version": "4.0.2",
@@ -7375,14 +7369,33 @@
       }
     },
     "@actions/github": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/@actions/github/-/github-6.0.0.tgz",
-      "integrity": "sha512-alScpSVnYmjNEXboZjarjukQEzgCRmjMv6Xj47fsdnqGS73bjJNDpiiXmp8jr0UZLdUB6d9jW63IcmddUP+l0g==",
+      "version": "9.1.0",
+      "resolved": "https://registry.npmjs.org/@actions/github/-/github-9.1.0.tgz",
+      "integrity": "sha512-u0hDGQeCS+7VNoLA8hYG65RLdPLMaPGfka0sZ0up7P0AiShqfX6xcuXNteGkQ7X7Tod7AMNwHd4p7DS63i8zzA==",
       "requires": {
-        "@actions/http-client": "^2.2.0",
-        "@octokit/core": "^5.0.1",
-        "@octokit/plugin-paginate-rest": "^9.0.0",
-        "@octokit/plugin-rest-endpoint-methods": "^10.0.0"
+        "@actions/http-client": "^3.0.2",
+        "@octokit/core": "^7.0.6",
+        "@octokit/plugin-paginate-rest": "^14.0.0",
+        "@octokit/plugin-rest-endpoint-methods": "^17.0.0",
+        "@octokit/request": "^10.0.7",
+        "@octokit/request-error": "^7.1.0",
+        "undici": "^6.23.0"
+      },
+      "dependencies": {
+        "@actions/http-client": {
+          "version": "3.0.2",
+          "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.2.tgz",
+          "integrity": "sha512-JP38FYYpyqvUsz+Igqlc/JG6YO9PaKuvqjM3iGvaLqFnJ7TFmcLyy2IDrY0bI0qCQug8E9K+elv5ZNfw62ZJzA==",
+          "requires": {
+            "tunnel": "^0.0.6",
+            "undici": "^6.23.0"
+          }
+        },
+        "undici": {
+          "version": "6.24.1",
+          "resolved": "https://registry.npmjs.org/undici/-/undici-6.24.1.tgz",
+          "integrity": "sha512-sC+b0tB1whOCzbtlx20fx3WgCXwkW627p4EA9uM+/tNNPkSS+eSEld6pAs9nDv7WbY1UUljBMYPtu9BCOrCWKA=="
+        }
       }
     },
     "@actions/glob": {
@@ -8305,169 +8318,107 @@
       }
     },
     "@octokit/auth-token": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-4.0.0.tgz",
-      "integrity": "sha512-tY/msAuJo6ARbK6SPIxZrPBms3xPbfwBrulZe0Wtr/DIY9lje2HeV1uoebShn6mx7SjCHif6EjMvoREj+gZ+SA=="
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-6.0.0.tgz",
+      "integrity": "sha512-P4YJBPdPSpWTQ1NU4XYdvHvXJJDxM6YwpS0FZHRgP7YFkdVxsWcpWGy/NVqlAA7PcPCnMacXlRm1y2PFZRWL/w=="
     },
     "@octokit/core": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/@octokit/core/-/core-5.0.1.tgz",
-      "integrity": "sha512-lyeeeZyESFo+ffI801SaBKmCfsvarO+dgV8/0gD8u1d87clbEdWsP5yC+dSj3zLhb2eIf5SJrn6vDz9AheETHw==",
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/@octokit/core/-/core-7.0.6.tgz",
+      "integrity": "sha512-DhGl4xMVFGVIyMwswXeyzdL4uXD5OGILGX5N8Y+f6W7LhC1Ze2poSNrkF/fedpVDHEEZ+PHFW0vL14I+mm8K3Q==",
       "requires": {
-        "@octokit/auth-token": "^4.0.0",
-        "@octokit/graphql": "^7.0.0",
-        "@octokit/request": "^8.0.2",
-        "@octokit/request-error": "^5.0.0",
-        "@octokit/types": "^12.0.0",
-        "before-after-hook": "^2.2.0",
-        "universal-user-agent": "^6.0.0"
+        "@octokit/auth-token": "^6.0.0",
+        "@octokit/graphql": "^9.0.3",
+        "@octokit/request": "^10.0.6",
+        "@octokit/request-error": "^7.0.2",
+        "@octokit/types": "^16.0.0",
+        "before-after-hook": "^4.0.0",
+        "universal-user-agent": "^7.0.0"
       }
     },
     "@octokit/endpoint": {
-      "version": "9.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-9.0.0.tgz",
-      "integrity": "sha512-szrQhiqJ88gghWY2Htt8MqUDO6++E/EIXqJ2ZEp5ma3uGS46o7LZAzSLt49myB7rT+Hfw5Y6gO3LmOxGzHijAQ==",
+      "version": "11.0.3",
+      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-11.0.3.tgz",
+      "integrity": "sha512-FWFlNxghg4HrXkD3ifYbS/IdL/mDHjh9QcsNyhQjN8dplUoZbejsdpmuqdA76nxj2xoWPs7p8uX2SNr9rYu0Ag==",
       "requires": {
-        "@octokit/types": "^11.0.0",
-        "is-plain-object": "^5.0.0",
-        "universal-user-agent": "^6.0.0"
-      },
-      "dependencies": {
-        "@octokit/openapi-types": {
-          "version": "18.0.0",
-          "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-18.0.0.tgz",
-          "integrity": "sha512-V8GImKs3TeQRxRtXFpG2wl19V7444NIOTDF24AWuIbmNaNYOQMWRbjcGDXV5B+0n887fgDcuMNOmlul+k+oJtw=="
-        },
-        "@octokit/types": {
-          "version": "11.1.0",
-          "resolved": "https://registry.npmjs.org/@octokit/types/-/types-11.1.0.tgz",
-          "integrity": "sha512-Fz0+7GyLm/bHt8fwEqgvRBWwIV1S6wRRyq+V6exRKLVWaKGsuy6H9QFYeBVDV7rK6fO3XwHgQOPxv+cLj2zpXQ==",
-          "requires": {
-            "@octokit/openapi-types": "^18.0.0"
-          }
-        }
+        "@octokit/types": "^16.0.0",
+        "universal-user-agent": "^7.0.2"
       }
     },
     "@octokit/graphql": {
-      "version": "7.0.1",
-      "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-7.0.1.tgz",
-      "integrity": "sha512-T5S3oZ1JOE58gom6MIcrgwZXzTaxRnxBso58xhozxHpOqSTgDS6YNeEUvZ/kRvXgPrRz/KHnZhtb7jUMRi9E6w==",
+      "version": "9.0.3",
+      "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-9.0.3.tgz",
+      "integrity": "sha512-grAEuupr/C1rALFnXTv6ZQhFuL1D8G5y8CN04RgrO4FIPMrtm+mcZzFG7dcBm+nq+1ppNixu+Jd78aeJOYxlGA==",
       "requires": {
-        "@octokit/request": "^8.0.1",
-        "@octokit/types": "^11.0.0",
-        "universal-user-agent": "^6.0.0"
-      },
-      "dependencies": {
-        "@octokit/openapi-types": {
-          "version": "18.0.0",
-          "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-18.0.0.tgz",
-          "integrity": "sha512-V8GImKs3TeQRxRtXFpG2wl19V7444NIOTDF24AWuIbmNaNYOQMWRbjcGDXV5B+0n887fgDcuMNOmlul+k+oJtw=="
-        },
-        "@octokit/types": {
-          "version": "11.1.0",
-          "resolved": "https://registry.npmjs.org/@octokit/types/-/types-11.1.0.tgz",
-          "integrity": "sha512-Fz0+7GyLm/bHt8fwEqgvRBWwIV1S6wRRyq+V6exRKLVWaKGsuy6H9QFYeBVDV7rK6fO3XwHgQOPxv+cLj2zpXQ==",
-          "requires": {
-            "@octokit/openapi-types": "^18.0.0"
-          }
-        }
+        "@octokit/request": "^10.0.6",
+        "@octokit/types": "^16.0.0",
+        "universal-user-agent": "^7.0.0"
       }
     },
     "@octokit/openapi-types": {
-      "version": "19.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-19.0.0.tgz",
-      "integrity": "sha512-PclQ6JGMTE9iUStpzMkwLCISFn/wDeRjkZFIKALpvJQNBGwDoYYi2fFvuHwssoQ1rXI5mfh6jgTgWuddeUzfWw=="
+      "version": "27.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-27.0.0.tgz",
+      "integrity": "sha512-whrdktVs1h6gtR+09+QsNk2+FO+49j6ga1c55YZudfEG+oKJVvJLQi3zkOm5JjiUXAagWK2tI2kTGKJ2Ys7MGA=="
     },
     "@octokit/plugin-paginate-rest": {
-      "version": "9.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-9.0.0.tgz",
-      "integrity": "sha512-oIJzCpttmBTlEhBmRvb+b9rlnGpmFgDtZ0bB6nq39qIod6A5DP+7RkVLMOixIgRCYSHDTeayWqmiJ2SZ6xgfdw==",
+      "version": "14.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-14.0.0.tgz",
+      "integrity": "sha512-fNVRE7ufJiAA3XUrha2omTA39M6IXIc6GIZLvlbsm8QOQCYvpq/LkMNGyFlB1d8hTDzsAXa3OKtybdMAYsV/fw==",
       "requires": {
-        "@octokit/types": "^12.0.0"
+        "@octokit/types": "^16.0.0"
       }
     },
     "@octokit/plugin-request-log": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-request-log/-/plugin-request-log-4.0.0.tgz",
-      "integrity": "sha512-2uJI1COtYCq8Z4yNSnM231TgH50bRkheQ9+aH8TnZanB6QilOnx8RMD2qsnamSOXtDj0ilxvevf5fGsBhBBzKA==",
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-request-log/-/plugin-request-log-6.0.0.tgz",
+      "integrity": "sha512-UkOzeEN3W91/eBq9sPZNQ7sUBvYCqYbrrD8gTbBuGtHEuycE4/awMXcYvx6sVYo7LypPhmQwwpUe4Yyu4QZN5Q==",
       "requires": {}
     },
     "@octokit/plugin-rest-endpoint-methods": {
-      "version": "10.0.1",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-10.0.1.tgz",
-      "integrity": "sha512-fgS6HPkPvJiz8CCliewLyym9qAx0RZ/LKh3sATaPfM41y/O2wQ4Z9MrdYeGPVh04wYmHFmWiGlKPC7jWVtZXQA==",
+      "version": "17.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-17.0.0.tgz",
+      "integrity": "sha512-B5yCyIlOJFPqUUeiD0cnBJwWJO8lkJs5d8+ze9QDP6SvfiXSz1BF+91+0MeI1d2yxgOhU/O+CvtiZ9jSkHhFAw==",
       "requires": {
-        "@octokit/types": "^12.0.0"
+        "@octokit/types": "^16.0.0"
       }
     },
     "@octokit/plugin-retry": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-retry/-/plugin-retry-6.0.1.tgz",
-      "integrity": "sha512-SKs+Tz9oj0g4p28qkZwl/topGcb0k0qPNX/i7vBKmDsjoeqnVfFUquqrE/O9oJY7+oLzdCtkiWSXLpLjvl6uog==",
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-retry/-/plugin-retry-8.1.0.tgz",
+      "integrity": "sha512-O1FZgXeiGb2sowEr/hYTr6YunGdSAFWnr2fyW39Ah85H8O33ELASQxcvOFF5LE6Tjekcyu2ms4qAzJVhSaJxTw==",
       "requires": {
-        "@octokit/request-error": "^5.0.0",
-        "@octokit/types": "^12.0.0",
+        "@octokit/request-error": "^7.0.2",
+        "@octokit/types": "^16.0.0",
         "bottleneck": "^2.15.3"
       }
     },
     "@octokit/request": {
-      "version": "8.1.1",
-      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-8.1.1.tgz",
-      "integrity": "sha512-8N+tdUz4aCqQmXl8FpHYfKG9GelDFd7XGVzyN8rc6WxVlYcfpHECnuRkgquzz+WzvHTK62co5di8gSXnzASZPQ==",
+      "version": "10.0.8",
+      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-10.0.8.tgz",
+      "integrity": "sha512-SJZNwY9pur9Agf7l87ywFi14W+Hd9Jg6Ifivsd33+/bGUQIjNujdFiXII2/qSlN2ybqUHfp5xpekMEjIBTjlSw==",
       "requires": {
-        "@octokit/endpoint": "^9.0.0",
-        "@octokit/request-error": "^5.0.0",
-        "@octokit/types": "^11.1.0",
-        "is-plain-object": "^5.0.0",
-        "universal-user-agent": "^6.0.0"
-      },
-      "dependencies": {
-        "@octokit/openapi-types": {
-          "version": "18.0.0",
-          "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-18.0.0.tgz",
-          "integrity": "sha512-V8GImKs3TeQRxRtXFpG2wl19V7444NIOTDF24AWuIbmNaNYOQMWRbjcGDXV5B+0n887fgDcuMNOmlul+k+oJtw=="
-        },
-        "@octokit/types": {
-          "version": "11.1.0",
-          "resolved": "https://registry.npmjs.org/@octokit/types/-/types-11.1.0.tgz",
-          "integrity": "sha512-Fz0+7GyLm/bHt8fwEqgvRBWwIV1S6wRRyq+V6exRKLVWaKGsuy6H9QFYeBVDV7rK6fO3XwHgQOPxv+cLj2zpXQ==",
-          "requires": {
-            "@octokit/openapi-types": "^18.0.0"
-          }
-        }
+        "@octokit/endpoint": "^11.0.3",
+        "@octokit/request-error": "^7.0.2",
+        "@octokit/types": "^16.0.0",
+        "fast-content-type-parse": "^3.0.0",
+        "json-with-bigint": "^3.5.3",
+        "universal-user-agent": "^7.0.2"
       }
     },
     "@octokit/request-error": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-5.0.0.tgz",
-      "integrity": "sha512-1ue0DH0Lif5iEqT52+Rf/hf0RmGO9NWFjrzmrkArpG9trFfDM/efx00BJHdLGuro4BR/gECxCU2Twf5OKrRFsQ==",
+      "version": "7.1.0",
+      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-7.1.0.tgz",
+      "integrity": "sha512-KMQIfq5sOPpkQYajXHwnhjCC0slzCNScLHs9JafXc4RAJI+9f+jNDlBNaIMTvazOPLgb4BnlhGJOTbnN0wIjPw==",
       "requires": {
-        "@octokit/types": "^11.0.0",
-        "deprecation": "^2.0.0",
-        "once": "^1.4.0"
-      },
-      "dependencies": {
-        "@octokit/openapi-types": {
-          "version": "18.0.0",
-          "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-18.0.0.tgz",
-          "integrity": "sha512-V8GImKs3TeQRxRtXFpG2wl19V7444NIOTDF24AWuIbmNaNYOQMWRbjcGDXV5B+0n887fgDcuMNOmlul+k+oJtw=="
-        },
-        "@octokit/types": {
-          "version": "11.1.0",
-          "resolved": "https://registry.npmjs.org/@octokit/types/-/types-11.1.0.tgz",
-          "integrity": "sha512-Fz0+7GyLm/bHt8fwEqgvRBWwIV1S6wRRyq+V6exRKLVWaKGsuy6H9QFYeBVDV7rK6fO3XwHgQOPxv+cLj2zpXQ==",
-          "requires": {
-            "@octokit/openapi-types": "^18.0.0"
-          }
-        }
+        "@octokit/types": "^16.0.0"
       }
     },
     "@octokit/types": {
-      "version": "12.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-12.0.0.tgz",
-      "integrity": "sha512-EzD434aHTFifGudYAygnFlS1Tl6KhbTynEWELQXIbTY8Msvb5nEqTZIm7sbPEt4mQYLZwu3zPKVdeIrw0g7ovg==",
+      "version": "16.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-16.0.0.tgz",
+      "integrity": "sha512-sKq+9r1Mm4efXW1FCk7hFSeJo4QKreL/tTbR0rz/qx/r1Oa2VV83LTA/H/MuCOX7uCIJmQVRKBcbmWoySjAnSg==",
       "requires": {
-        "@octokit/openapi-types": "^19.0.0"
+        "@octokit/openapi-types": "^27.0.0"
       }
     },
     "@pkgr/utils": {
@@ -9042,9 +8993,9 @@
       "integrity": "sha1-ibTRmasr7kneFk6gK4nORi1xt2c="
     },
     "before-after-hook": {
-      "version": "2.2.2",
-      "resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-2.2.2.tgz",
-      "integrity": "sha512-3pZEU3NT5BFUo/AD5ERPWOgQOCZITni6iavr5AUw5AUwQjMlI0kzu5btnyD39AF0gUEsDPwJT+oY1ORBJijPjQ=="
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-4.0.0.tgz",
+      "integrity": "sha512-q6tR3RPqIB1pMiTRMFcZwuG5T8vwp+vUvEG0vuI6B+Rikh5BfPp2fQ82c925FOs+b0lcFQ8CFrL+KbilfZFhOQ=="
     },
     "big-integer": {
       "version": "1.6.51",
@@ -9504,11 +9455,6 @@
         "object-keys": "^1.1.1"
       }
     },
-    "deprecation": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/deprecation/-/deprecation-2.3.1.tgz",
-      "integrity": "sha512-xmHIy4F3scKVwMsQ4WnVaS8bHOx0DmVwRywosKhaILI0ywMDWPtBSku2HNxRvF7jtwDRsoEwYQSfbxj8b7RlJQ=="
-    },
     "detect-newline": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/detect-newline/-/detect-newline-3.1.0.tgz",
@@ -9971,6 +9917,11 @@
         }
       }
     },
+    "fast-content-type-parse": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/fast-content-type-parse/-/fast-content-type-parse-3.0.0.tgz",
+      "integrity": "sha512-ZvLdcY8P+N8mGQJahJV5G4U88CSvT1rP8ApL6uETe88MBXrBHAkZlSEySdUlyztF7ccb+Znos3TFqaepHxdhBg=="
+    },
     "fast-deep-equal": {
       "version": "3.1.3",
       "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
@@ -10520,11 +10471,6 @@
       "integrity": "sha512-Fd4gABb+ycGAmKou8eMftCupSir5lRxqf4aD/vd0cD2qc4HL07OjCeuHMr8Ro4CoMaeCKDB0/ECBOVWjTwUvPQ==",
       "dev": true
     },
-    "is-plain-object": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/is-plain-object/-/is-plain-object-5.0.0.tgz",
-      "integrity": "sha512-VRSzKkbMm5jMDoKLbltAkFQ5Qr7VDiTFGXxYFXXowVj387GeGNOCsOH6Msy00SGZ3Fp84b1Naa1psqgcCIEP5Q=="
-    },
     "is-regex": {
       "version": "1.1.4",
       "resolved": "https://registry.npmjs.org/is-regex/-/is-regex-1.1.4.tgz",
@@ -11430,6 +11376,11 @@
       "integrity": "sha1-nbe1lJatPzz+8wp1FC0tkwrXJlE=",
       "dev": true
     },
+    "json-with-bigint": {
+      "version": "3.5.8",
+      "resolved": "https://registry.npmjs.org/json-with-bigint/-/json-with-bigint-3.5.8.tgz",
+      "integrity": "sha512-eq/4KP6K34kwa7TcFdtvnftvHCD9KvHOGGICWwMFc4dOOKF5t4iYqnfLK8otCRCRv06FXOzGGyqE8h8ElMvvdw=="
+    },
     "json5": {
       "version": "2.2.3",
       "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
@@ -11737,6 +11688,7 @@
       "version": "1.4.0",
       "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
       "integrity": "sha1-WDsap3WWHUsROsF9nFC6753Xa9E=",
+      "dev": true,
       "requires": {
         "wrappy": "1"
       }
@@ -12549,9 +12501,9 @@
       "integrity": "sha512-9UJ2xGDvQ43tYyVMpuHlsgApydB8ZKfVYTsLDhXkFL/6gfkp+U8xTGdh8pMJv1SpZna0zxG1DwsKZsreLbXBxw=="
     },
     "universal-user-agent": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-6.0.0.tgz",
-      "integrity": "sha512-isyNax3wXoKaulPDZWHQqbmIx1k2tb9fb3GGDBRxCscfYV2Ch7WxPArBsFEG8s/safwXTT7H4QGhaIkTp9447w=="
+      "version": "7.0.3",
+      "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.3.tgz",
+      "integrity": "sha512-TmnEAEAsBJVZM/AADELsK76llnwcf9vMKuPz8JflO1frO8Lchitr0fNaN9d+Ap0BjKtqWqd/J17qeDnXh8CL2A=="
     },
     "untildify": {
       "version": "4.0.0",
@@ -12662,7 +12614,8 @@
     "wrappy": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
-      "integrity": "sha1-tSQ9jz7BqjXxNkYFvA0QNuMKtp8="
+      "integrity": "sha1-tSQ9jz7BqjXxNkYFvA0QNuMKtp8=",
+      "dev": true
     },
     "write-file-atomic": {
       "version": "4.0.2",

package.json

@@ -4,14 +4,14 @@
   "engines": {
     "node": ">=24"
   },
-  "version": "7.0.1",
+  "version": "9.0.0",
   "author": "GitHub",
   "license": "MIT",
   "main": "dist/index.js",
   "types": "types/async-function.d.ts",
   "scripts": {
     "build": "npm run build:types && ncc build src/main.ts",
-    "build:types": "tsc src/async-function.ts -t es5 --declaration --allowJs --emitDeclarationOnly --outDir types",
+    "build:types": "tsc src/async-function.ts --target es2022 --module es2022 --moduleResolution bundler --declaration --emitDeclarationOnly --outDir types",
     "format:check": "prettier --check src __test__",
     "format:write": "prettier --write src __test__",
     "lint": "eslint src __test__",
@@ -28,6 +28,11 @@
       "^.+\\.ts$": [
         "ts-jest",
         {
+          "tsconfig": {
+            "target": "es2022",
+            "module": "commonjs",
+            "moduleResolution": "bundler"
+          },
           "diagnostics": {
             "ignoreCodes": [
               "151001"
@@ -40,12 +45,12 @@
   "dependencies": {
     "@actions/core": "^1.10.1",
     "@actions/exec": "^1.1.1",
-    "@actions/github": "^6.0.0",
+    "@actions/github": "^9.0.0",
     "@actions/glob": "^0.4.0",
     "@actions/io": "^1.1.3",
-    "@octokit/core": "^5.0.1",
-    "@octokit/plugin-request-log": "^4.0.0",
-    "@octokit/plugin-retry": "^6.0.1",
+    "@octokit/core": "^7.0.0",
+    "@octokit/plugin-request-log": "^6.0.0",
+    "@octokit/plugin-retry": "^8.0.0",
     "@types/node": "^24.1.0"
   },
   "devDependencies": {

src/async-function.ts

@@ -1,17 +1,17 @@
 import * as core from '@actions/core'
 import * as exec from '@actions/exec'
-import {Context} from '@actions/github/lib/context'
-import {GitHub} from '@actions/github/lib/utils'
+import type {context, getOctokit} from '@actions/github'
 import * as glob from '@actions/glob'
 import * as io from '@actions/io'
 
 const AsyncFunction = Object.getPrototypeOf(async () => null).constructor
 
 export declare type AsyncFunctionArguments = {
-  context: Context
+  context: typeof context
   core: typeof core
-  github: InstanceType<typeof GitHub>
-  octokit: InstanceType<typeof GitHub>
+  github: ReturnType<typeof getOctokit>
+  octokit: ReturnType<typeof getOctokit>
+  getOctokit: typeof getOctokit
   exec: typeof exec
   glob: typeof glob
   io: typeof io

src/create-configured-getoctokit.ts

@@ -0,0 +1,64 @@
+import {getOctokit} from '@actions/github'
+
+/**
+ * Strip keys whose value is `undefined` so they don't clobber defaults
+ * during object spread (e.g. `{baseUrl: undefined}` would wipe a GHES URL).
+ */
+function stripUndefined(obj: Record<string, unknown>): Record<string, unknown> {
+  return Object.fromEntries(
+    Object.entries(obj).filter(([, v]) => v !== undefined)
+  )
+}
+
+/**
+ * Creates a wrapped getOctokit that inherits default options and plugins.
+ * Secondary clients created via the wrapper get the same retry, logging,
+ * orchestration ID, and retries count as the pre-built `github` client.
+ *
+ * - `request` and `retry` are deep-merged so partial overrides
+ *   (e.g. `{request: {timeout: 5000}}`) don't clobber inherited values.
+ * - `undefined` values in both default and user options are stripped to prevent
+ *   accidental clobbering (e.g. GHES `baseUrl`, or `log: undefined` from defaults).
+ * - Default plugins (retry, requestLog) are always included; duplicates are skipped.
+ */
+export function createConfiguredGetOctokit(
+  rawGetOctokit: typeof getOctokit,
+  defaultOptions: Record<string, unknown>,
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  ...defaultPlugins: any[]
+): typeof getOctokit {
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  return ((token: string, options?: any, ...plugins: any[]) => {
+    const cleanDefaults = stripUndefined(defaultOptions)
+    const userOpts = stripUndefined(options ?? {})
+
+    const defaultRequest =
+      (cleanDefaults.request as Record<string, unknown> | undefined) ?? {}
+    const userRequest = stripUndefined(
+      (userOpts.request as Record<string, unknown> | undefined) ?? {}
+    )
+
+    const defaultRetry =
+      (cleanDefaults.retry as Record<string, unknown> | undefined) ?? {}
+    const userRetry = stripUndefined(
+      (userOpts.retry as Record<string, unknown> | undefined) ?? {}
+    )
+
+    const merged = {
+      ...cleanDefaults,
+      ...userOpts,
+      request: {...defaultRequest, ...userRequest},
+      retry: {...defaultRetry, ...userRetry}
+    }
+
+    // Deduplicate: default plugins first, then user plugins that aren't already present
+    const allPlugins = [...defaultPlugins]
+    for (const plugin of plugins) {
+      if (!allPlugins.includes(plugin)) {
+        allPlugins.push(plugin)
+      }
+    }
+
+    return rawGetOctokit(token, merged, ...allPlugins)
+  }) as typeof getOctokit
+}

src/main.ts

@@ -8,6 +8,7 @@ import {requestLog} from '@octokit/plugin-request-log'
 import {retry} from '@octokit/plugin-retry'
 import {RequestRequestOptions} from '@octokit/types'
 import {callAsyncFunction} from './async-function'
+import {createConfiguredGetOctokit} from './create-configured-getoctokit'
 import {RetryOptions, getRetryOptions, parseNumberArray} from './retry-options'
 import {wrapRequire} from './wrap-require'
 
@@ -59,6 +60,16 @@ async function main(): Promise<void> {
   const github = getOctokit(token, opts, retry, requestLog)
   const script = core.getInput('script', {required: true})
 
+  // Wrap getOctokit so secondary clients inherit retry, logging,
+  // orchestration ID, and the action's retries input.
+  // Deep-copy opts to prevent shared references with the primary client.
+  const configuredGetOctokit = createConfiguredGetOctokit(
+    getOctokit,
+    {...opts, retry: {...opts.retry}, request: {...opts.request}},
+    retry,
+    requestLog
+  )
+
   // Using property/value shorthand on `require` (e.g. `{require}`) causes compilation errors.
   const result = await callAsyncFunction(
     {
@@ -66,6 +77,7 @@ async function main(): Promise<void> {
       __original_require__: __non_webpack_require__,
       github,
       octokit: github,
+      getOctokit: configuredGetOctokit,
       context,
       core,
       exec,

src/retry-options.ts

@@ -1,5 +1,5 @@
 import * as core from '@actions/core'
-import {OctokitOptions} from '@octokit/core/dist-types/types'
+import {OctokitOptions} from '@octokit/core/types'
 import {RequestRequestOptions} from '@octokit/types'
 
 export type RetryOptions = {

tsconfig.json

@@ -1,7 +1,8 @@
 {
   "compilerOptions": {
-    "target": "es2018",
-    "moduleResolution": "node",
+    "target": "es2022",
+    "module": "es2022",
+    "moduleResolution": "bundler",
     "strict": true,
     "forceConsistentCasingInFileNames": true
   },

types/async-function.d.ts

@@ -1,15 +1,15 @@
 /// <reference types="node" />
 import * as core from '@actions/core';
 import * as exec from '@actions/exec';
-import { Context } from '@actions/github/lib/context';
-import { GitHub } from '@actions/github/lib/utils';
+import type { context, getOctokit } from '@actions/github';
 import * as glob from '@actions/glob';
 import * as io from '@actions/io';
 export declare type AsyncFunctionArguments = {
-    context: Context;
+    context: typeof context;
     core: typeof core;
-    github: InstanceType<typeof GitHub>;
-    octokit: InstanceType<typeof GitHub>;
+    github: ReturnType<typeof getOctokit>;
+    octokit: ReturnType<typeof getOctokit>;
+    getOctokit: typeof getOctokit;
     exec: typeof exec;
     glob: typeof glob;
     io: typeof io;