feat!: expose getOctokit in script context and upgrade to @actions/github v9 by salmanmkc · Pull Request #700 · actions/github-script

salmanmkc · 2026-03-01T00:26:07Z

Summary

Exposes a pre-configured getOctokit factory function in the script context, enabling multi-token workflows directly inside github-script. Also upgrades the action to @actions/github v9.

This is a major version bump (v9) that combines ADR Steps 1 and 3 into a single release.

What's new

`getOctokit(token, opts?)` — create additional authenticated clients

Users can now create additional Octokit clients with different tokens, without needing require('@actions/github'):

- uses: actions/github-script@v9
  env:
    APP_TOKEN: ${{ secrets.MY_APP_TOKEN }}
  with:
    script: |
      # `github` uses the default GITHUB_TOKEN
      await github.rest.issues.addLabels({
        issue_number: context.issue.number,
        owner: context.repo.owner,
        repo: context.repo.repo,
        labels: ['triage']
      })

      # Create a second client with a different token
      const appOctokit = getOctokit(process.env.APP_TOKEN)
      await appOctokit.rest.repos.createDispatchEvent({
        owner: 'my-org',
        repo: 'another-repo',
        event_type: 'trigger-deploy'
      })

The returned client inherits all the same plugins and configuration as the primary github client (retry, request-log, proxy support). Custom options can be passed to override specific settings:

const ghes = getOctokit(process.env.GHES_TOKEN, {
  baseUrl: 'https://github.example.com/api/v3'
})

`@actions/github` v9

Upgraded from @actions/github v6 to v9, bringing latest Octokit types and the orchestration ID idempotency guard (toolkit#2364).

Technical details

Factory implementation (`src/create-configured-getoctokit.ts`)

Deep-merges user options with action defaults (retry config, request settings, proxy)
Deduplicates plugins if user options include plugins already registered
Strips undefined values to prevent clobbering defaults
Returns a fully configured Octokit client via @actions/github's getOctokit()

Script binding injection (`src/async-function.ts`)

Refactored how bindings (github, context, core, getOctokit, etc.) are passed into user scripts — uses scope-based injection instead of function parameters, which is more robust and avoids edge-case issues with variable declarations.

Test coverage

37 tests total across 4 test suites
15 unit tests for the factory function (deep merge, plugin dedup, strip undefined, etc.)
Integration workflow tests for multi-token usage

Demo

Full 13-job demo workflow:
bbq-beets-four-nines/salmanmkc-test

Checklist

getOctokit factory exposed in script context
@actions/github upgraded to v9
Package version bumped to 9.0.0
README updated with v9 examples and getOctokit documentation
37 tests passing, 15/15 CI checks green
dist rebuilt
Licensed check passing

github-actions · 2026-03-01T00:26:17Z

Hello from actions/github-script! (46b978f)

Copilot

Pull request overview

This PR exposes getOctokit in the github-script runtime context so user scripts can create additional authenticated Octokit clients (e.g., for multi-token workflows) without relying on require('@actions/github').

Changes:

Passes getOctokit into the script execution context in src/main.ts.
Extends the AsyncFunctionArguments TypeScript type to include getOctokit with an Octokit-typed signature.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src/main.ts	Adds `getOctokit` to the object passed into `callAsyncFunction` so scripts can access it.
src/async-function.ts	Updates the script context type (`AsyncFunctionArguments`) to type `getOctokit` and imports Octokit types.

Comments suppressed due to low confidence (2)

src/main.ts:71

getOctokit is being passed through directly from @actions/github, so any Octokit clients created inside the user script won’t automatically inherit this action’s configured defaults (e.g., base-url for GHES, user-agent with orchestration ID, retries/request options, and the installed retry/requestLog plugins). This can lead to surprising differences between github and getOctokit(...) behavior. Consider exposing a wrapper that pre-applies the same options/plugins by default (while still allowing callers to override/extend options/plugins when needed).

      github,
      octokit: github,
      getOctokit,
      context,
      core,

src/async-function.ts:20

This adds a new deep import from @octokit/core/types, but the codebase already imports Octokit types via @octokit/core/dist-types/types (e.g. src/retry-options.ts). To stay consistent (and to reduce the risk of relying on a non-exported subpath), align the import path with the existing convention or derive the type directly from @actions/github (e.g., type getOctokit as typeof import('@actions/github').getOctokit) so the signature can’t drift from the actual implementation.

import {GitHub} from '@actions/github/lib/utils'
import * as glob from '@actions/glob'
import * as io from '@actions/io'
import type {OctokitOptions, OctokitPlugin} from '@octokit/core/types'

const AsyncFunction = Object.getPrototypeOf(async () => null).constructor

export declare type AsyncFunctionArguments = {
  context: Context
  core: typeof core
  github: InstanceType<typeof GitHub>
  octokit: InstanceType<typeof GitHub>
  getOctokit: (
    token: string,
    options?: OctokitOptions,
    ...additionalPlugins: OctokitPlugin[]
  ) => InstanceType<typeof GitHub>

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

…ild dist/

- @actions/github: ^6.0.0 → ^9.0.0 - @octokit/core: ^5.0.1 → ^7.0.0 - @octokit/plugin-request-log: ^4.0.0 → ^6.0.0 - @octokit/plugin-retry: ^6.0.1 → ^8.0.0 - Update tsconfig.json to use moduleResolution: "bundler" for ESM exports map support - Update import paths for new package structures - Update build:types script for compatible compiler options Co-authored-by: angel-jiakou <[email protected]> Agent-Logs-Url: https://github.com/actions/github-script/sessions/17de5ca1-8bdc-41e4-a06d-ab2d8c2e6e8c

Verifies the real getOctokit from @actions/github creates functional Octokit clients when invoked through callAsyncFunction, ensuring: - Secondary clients have full REST/GraphQL API surface - Secondary clients are independent from primary github client - GHES base URL option is accepted - Multiple tokens produce distinct client instances

Extract createConfiguredGetOctokit factory that wraps getOctokit with: - retry and requestLog plugins (from action defaults) - retries count, proxy agent, orchestration ID user-agent - deep-merge for request options so user overrides don't clobber retries - plugin deduplication to prevent double-application This ensures secondary Octokit clients created via getOctokit() in github-script workflows inherit the same defaults as the primary github client.

- Rename context binding from getOctokit to createOctokit to avoid SyntaxError when users write const { getOctokit } = require(...) in their scripts (~10 public workflows affected) - Strip undefined values from user options to prevent clobbering defaults (e.g. GHES baseUrl) - Deep-merge retry options alongside request options - Use nullish coalescing (??) instead of logical OR (||) - Shallow-copy opts to prevent shared reference mutation - Add tests: undefined stripping, retry merge, falsy value preservation, no mutation of defaults - 32 tests passing, lint clean, dist rebuilt

Merges the @actions/github v9 upgrade branch into the createOctokit feature branch, combining ADR steps 1 and 3 into a single major release. Changes from v9 upgrade: - @actions/github 6.x → 9.0.0 (ESM-only) - @octokit/core v5→v7, plugin-request-log v4→v6, plugin-retry v6→v8 - tsconfig: moduleResolution bundler, module/target es2022 - ts-jest: module commonjs override for CJS test execution - License file updates for new dependency versions Conflict resolutions: - src/async-function.ts: v9 import style + createOctokit type - types/async-function.d.ts: aligned with .ts file - integration.yml: v9 UA checks + createOctokit test job - dist/index.js: rebuilt via ncc Additional fix: - getoctokit-integration.test.ts: use mock instead of direct @actions/github import (ESM-only v9 incompatible with Jest CJS) All 32 tests passing, TypeScript clean, lint clean.

…it name Replace function-parameter injection with const destructuring + block scope so that user scripts can shadow injected names (e.g. const { getOctokit } = ...) without SyntaxError. This eliminates the need for the createOctokit rename and aligns with the ADR's getOctokit naming. Changes: - callAsyncFunction now wraps user source in a block: const {...} = __scope__; { source } - Renamed createOctokit binding back to getOctokit everywhere - Added 5 new tests: const/let shadowing, await, return, syntax error, access - Updated integration workflow and type declarations

…hanges section

…ards - Change const to var destructuring in callAsyncFunction so var redeclaration and reassignment of injected names still works (v8 compat) - Add identifier validation for argument keys (defensive for exported API) - Add __scope__ collision guard - Fix integration test hardcoded repo name to use github.repository - Add 4 new tests: var redecl, reassignment, invalid key, __scope__ guard

feat: expose getOctokit in script context for multi-token workflows

00afa0f

Copilot AI review requested due to automatic review settings March 1, 2026 00:26

salmanmkc requested a review from a team as a code owner March 1, 2026 00:26

salmanmkc temporarily deployed to debug-integration-test March 1, 2026 00:26 — with GitHub Actions Inactive

Copilot started reviewing on behalf of salmanmkc March 1, 2026 00:26 View session

Copilot AI reviewed Mar 1, 2026

View reviewed changes

fix: use typeof getOctokit instead of deep @octokit/core import, rebu…

a7dc0e4

…ild dist/

salmanmkc temporarily deployed to debug-integration-test March 1, 2026 01:30 — with GitHub Actions Inactive

Add docs and tests for getOctokit script context

cc685dc

salmanmkc temporarily deployed to debug-integration-test March 9, 2026 11:47 — with GitHub Actions Inactive

Fix user-agent integration test for orchestration ID

7cc36ca

salmanmkc temporarily deployed to debug-integration-test March 9, 2026 11:52 — with GitHub Actions Inactive

Add integration test for getOctokit client creation

74a7682

salmanmkc temporarily deployed to debug-integration-test March 9, 2026 12:02 — with GitHub Actions Inactive

pelikhan approved these changes Mar 9, 2026

View reviewed changes

Copilot AI and others added 5 commits March 23, 2026 20:17

Initial plan

179b645

Fix user-agent integration test for orchestration ID

4b873e4

Update license cache for upgraded dependencies

fa89b8b

Address comment

c1a9577

salmanmkc temporarily deployed to debug-integration-test April 7, 2026 15:47 — with GitHub Actions Inactive

test: add multi-token usage tests for getOctokit

2fe016f

salmanmkc force-pushed the salmanmkc/expose-getoctokit branch from c7fb361 to 2fe016f Compare April 7, 2026 15:50

salmanmkc temporarily deployed to debug-integration-test April 7, 2026 15:50 — with GitHub Actions Inactive

salmanmkc temporarily deployed to debug-integration-test April 7, 2026 16:08 — with GitHub Actions Inactive

salmanmkc temporarily deployed to debug-integration-test April 8, 2026 20:41 — with GitHub Actions Inactive

salmanmkc force-pushed the salmanmkc/expose-getoctokit branch from 1bdc919 to 7f52c47 Compare April 8, 2026 20:44

salmanmkc temporarily deployed to debug-integration-test April 8, 2026 20:44 — with GitHub Actions Inactive

salmanmkc force-pushed the salmanmkc/expose-getoctokit branch from 7f52c47 to 95933be Compare April 8, 2026 20:48

salmanmkc temporarily deployed to debug-integration-test April 8, 2026 20:48 — with GitHub Actions Inactive

salmanmkc temporarily deployed to debug-integration-test April 8, 2026 21:39 — with GitHub Actions Inactive

salmanmkc added 2 commits April 8, 2026 21:40

fix: update integration test to use createOctokit binding

7ece71c

salmanmkc force-pushed the salmanmkc/expose-getoctokit branch from 47f6d8e to 7ece71c Compare April 8, 2026 21:41

salmanmkc temporarily deployed to debug-integration-test April 8, 2026 21:41 — with GitHub Actions Inactive

style: fix prettier formatting

599b1f4

salmanmkc temporarily deployed to debug-integration-test April 8, 2026 21:46 — with GitHub Actions Inactive

salmanmkc changed the title ~~feat: expose getOctokit in script context for multi-token workflows~~ feat: add createOctokit to script context for multi-token workflows Apr 8, 2026

salmanmkc temporarily deployed to debug-integration-test April 9, 2026 08:00 — with GitHub Actions Inactive

salmanmkc temporarily deployed to debug-integration-test April 9, 2026 08:55 — with GitHub Actions Inactive

salmanmkc changed the title ~~feat: add createOctokit to script context for multi-token workflows~~ feat!: expose getOctokit in script context and upgrade to @actions/github v9 Apr 9, 2026

docs: update README examples from @v8 to @v9

c81f959

salmanmkc temporarily deployed to debug-integration-test April 9, 2026 09:03 — with GitHub Actions Inactive

salmanmkc added 2 commits April 9, 2026 09:05

chore: bump package version to 9.0.0, update @actions/github to 9.1.0

960b8b3

docs: expand getOctokit documentation with examples and v9 breaking c…

1715c9f

…hanges section

salmanmkc temporarily deployed to debug-integration-test April 9, 2026 09:10 — with GitHub Actions Inactive

chore: update licensed cache for @actions/github 9.1.0

69216c1

salmanmkc temporarily deployed to debug-integration-test April 9, 2026 09:22 — with GitHub Actions Inactive

docs: remove block-scope implementation detail from V9 breaking changes

ccf0882

salmanmkc temporarily deployed to debug-integration-test April 9, 2026 09:28 — with GitHub Actions Inactive

salmanmkc temporarily deployed to debug-integration-test April 9, 2026 10:02 — with GitHub Actions Inactive

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat!: expose getOctokit in script context and upgrade to @actions/github v9#700

feat!: expose getOctokit in script context and upgrade to @actions/github v9#700
salmanmkc wants to merge 24 commits intomainfrom
salmanmkc/expose-getoctokit

salmanmkc commented Mar 1, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Mar 1, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

salmanmkc commented Mar 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What's new

getOctokit(token, opts?) — create additional authenticated clients

@actions/github v9

Technical details

Factory implementation (src/create-configured-getoctokit.ts)

Script binding injection (src/async-function.ts)

Test coverage

Demo

Checklist

Uh oh!

github-actions bot commented Mar 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

salmanmkc commented Mar 1, 2026 •

edited

Loading

`getOctokit(token, opts?)` — create additional authenticated clients

`@actions/github` v9

Factory implementation (`src/create-configured-getoctokit.ts`)

Script binding injection (`src/async-function.ts`)

github-actions bot commented Mar 1, 2026 •

edited

Loading