feat: add createOctokit to script context for multi-token workflows

.github/workflows/integration.yml

@@ -154,22 +154,58 @@ jobs:
             return endpoint({}).headers['user-agent']
           result-encoding: string
       - run: |
+          matches_user_agent() {
+            local actual="$1"
+            local prefix="$2"
+            [[ "$actual" =~ ^${prefix}(\ actions_orchestration_id/[^[:space:]]+)?\ octokit-core\.js/ ]]
+          }
+
           echo "- Validating user-agent default"
-          expected="actions/github-script octokit-core.js/"
-          if [[ "${{steps.user-agent-default.outputs.result}}" != "$expected"* ]]; then
-            echo $'::error::\u274C' "Expected user-agent to start with '$expected', got ${{steps.user-agent-default.outputs.result}}"
+          expected="actions/github-script"
+          if ! matches_user_agent "${{steps.user-agent-default.outputs.result}}" "$expected"; then
+            echo $'::error::\u274C' "Expected user-agent to start with '$expected' and include 'octokit-core.js/', got ${{steps.user-agent-default.outputs.result}}"
             exit 1
           fi
           echo "- Validating user-agent set to a value"
-          expected="foobar octokit-core.js/"
-          if [[ "${{steps.user-agent-set.outputs.result}}" != "$expected"* ]]; then
-            echo $'::error::\u274C' "Expected user-agent to start with '$expected', got ${{steps.user-agent-set.outputs.result}}"
+          expected="foobar"
+          if ! matches_user_agent "${{steps.user-agent-set.outputs.result}}" "$expected"; then
+            echo $'::error::\u274C' "Expected user-agent to start with '$expected' and include 'octokit-core.js/', got ${{steps.user-agent-set.outputs.result}}"
             exit 1
           fi
           echo "- Validating user-agent set to an empty string"
-          expected="actions/github-script octokit-core.js/"
-          if [[ "${{steps.user-agent-empty.outputs.result}}" != "$expected"* ]]; then
-            echo $'::error::\u274C' "Expected user-agent to start with '$expected', got ${{steps.user-agent-empty.outputs.result}}"
+          expected="actions/github-script"
+          if ! matches_user_agent "${{steps.user-agent-empty.outputs.result}}" "$expected"; then
+            echo $'::error::\u274C' "Expected user-agent to start with '$expected' and include 'octokit-core.js/', got ${{steps.user-agent-empty.outputs.result}}"
+            exit 1
+          fi
+          echo $'\u2705 Test passed' | tee -a $GITHUB_STEP_SUMMARY
+
+  test-get-octokit:
+    name: 'Integration test: createOctokit with token'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/install-dependencies
+      - id: secondary-client
+        name: Create a second client with createOctokit
+        uses: ./
+        env:
+          APP_TOKEN: ${{ github.token }}
+        with:
+          script: |
+            const appOctokit = createOctokit(process.env.APP_TOKEN)
+            const {data} = await appOctokit.rest.repos.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo
+            })
+
+            return `${appOctokit !== github}:${data.full_name}`
+          result-encoding: string
+      - run: |
+          echo "- Validating secondary client output"
+          expected="true:actions/github-script"
+          if [[ "${{steps.secondary-client.outputs.result}}" != "$expected" ]]; then
+            echo $'::error::\u274C' "Expected '$expected', got ${{steps.secondary-client.outputs.result}}"
             exit 1
           fi
           echo $'\u2705 Test passed' | tee -a $GITHUB_STEP_SUMMARY

README.md

@@ -504,6 +504,8 @@ The `GITHUB_TOKEN` used by default is scoped to the current repository, see [Aut
 
 If you need access to a different repository or an API that the `GITHUB_TOKEN` doesn't have permissions to, you can provide your own [PAT](https://help.github.com/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line) as a secret using the `github-token` input.
 
+If you need to use multiple tokens in the same script, `getOctokit` is also available in the script context so you can create additional authenticated clients without using `require('@actions/github')`.
+
 [Learn more about creating and using encrypted secrets](https://docs.github.com/actions/reference/encrypted-secrets)
 
 ```yaml
@@ -516,6 +518,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/github-script@v8
+        env:
+          APP_TOKEN: ${{ secrets.MY_OTHER_PAT }}
         with:
           github-token: ${{ secrets.MY_PAT }}
           script: |
@@ -525,6 +529,13 @@ jobs:
               repo: context.repo.repo,
               labels: ['Triage']
             })
+
+            const appOctokit = getOctokit(process.env.APP_TOKEN)
+            await appOctokit.rest.repos.createDispatchEvent({
+              owner: 'my-org',
+              repo: 'another-repo',
+              event_type: 'trigger-deploy'
+            })
 ```
 
 ### Using exec package

__test__/async-function.test.ts

@@ -8,6 +8,96 @@ describe('callAsyncFunction', () => {
     expect(result).toEqual('bar')
   })
 
+  test('passes createOctokit through the script context', async () => {
+    const createOctokit = jest.fn().mockReturnValue('secondary-client')
+
+    const result = await callAsyncFunction(
+      {createOctokit} as any,
+      "return createOctokit('token')"
+    )
+
+    expect(createOctokit).toHaveBeenCalledWith('token')
+    expect(result).toEqual('secondary-client')
+  })
+
+  test('createOctokit creates client independent from github', async () => {
+    const github = {rest: {issues: 'primary'}}
+    const createOctokit = jest
+      .fn()
+      .mockReturnValue({rest: {issues: 'secondary'}})
+
+    const result = await callAsyncFunction(
+      {github, createOctokit} as any,
+      `
+        const secondary = createOctokit('other-token')
+        return {
+          primary: github.rest.issues,
+          secondary: secondary.rest.issues,
+          different: github !== secondary
+        }
+      `
+    )
+
+    expect(result).toEqual({
+      primary: 'primary',
+      secondary: 'secondary',
+      different: true
+    })
+    expect(createOctokit).toHaveBeenCalledWith('other-token')
+  })
+
+  test('createOctokit passes options through', async () => {
+    const createOctokit = jest.fn().mockReturnValue('client-with-opts')
+
+    const result = await callAsyncFunction(
+      {createOctokit} as any,
+      `return createOctokit('my-token', { baseUrl: 'https://ghes.example.com/api/v3' })`
+    )
+
+    expect(createOctokit).toHaveBeenCalledWith('my-token', {
+      baseUrl: 'https://ghes.example.com/api/v3'
+    })
+    expect(result).toEqual('client-with-opts')
+  })
+
+  test('createOctokit supports plugins', async () => {
+    const createOctokit = jest.fn().mockReturnValue('client-with-plugins')
+
+    const result = await callAsyncFunction(
+      {createOctokit} as any,
+      `return createOctokit('my-token', { previews: ['v3'] }, 'pluginA', 'pluginB')`
+    )
+
+    expect(createOctokit).toHaveBeenCalledWith(
+      'my-token',
+      {previews: ['v3']},
+      'pluginA',
+      'pluginB'
+    )
+    expect(result).toEqual('client-with-plugins')
+  })
+
+  test('multiple createOctokit calls produce independent clients', async () => {
+    const createOctokit = jest
+      .fn()
+      .mockReturnValueOnce({id: 'client-a'})
+      .mockReturnValueOnce({id: 'client-b'})
+
+    const result = await callAsyncFunction(
+      {createOctokit} as any,
+      `
+        const a = createOctokit('token-a')
+        const b = createOctokit('token-b')
+        return { a: a.id, b: b.id, different: a !== b }
+      `
+    )
+
+    expect(createOctokit).toHaveBeenCalledTimes(2)
+    expect(createOctokit).toHaveBeenNthCalledWith(1, 'token-a')
+    expect(createOctokit).toHaveBeenNthCalledWith(2, 'token-b')
+    expect(result).toEqual({a: 'client-a', b: 'client-b', different: true})
+  })
+
   test('throws on ReferenceError', async () => {
     expect.assertions(1)