Bump actions/github-script from 8 to 9

[dependabot]

Bumps actions/github-script from 8 to 9.

Release notes

Sourced from actions/github-script's releases.

v9.0.0

New features:

• getOctokit factory function — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See Creating additional clients with getOctokit for details and examples.
• Orchestration ID in user-agent — The ACTIONS_ORCHESTRATION_ID environment variable is automatically appended to the user-agent string for request tracing.

Breaking changes:

• require('@actions/github') no longer works in scripts. The upgrade to @actions/github v9 (ESM-only) means require('@actions/github') will fail at runtime. If you previously used patterns like const { getOctokit } = require('@actions/github') to create secondary clients, use the new injected getOctokit function instead — it's available directly in the script context with no imports needed.
• getOctokit is now an injected function parameter. Scripts that declare const getOctokit = ... or let getOctokit = ... will get a SyntaxError because JavaScript does not allow const/let redeclaration of function parameters. Use the injected getOctokit directly, or use var getOctokit = ... if you need to redeclare it.
• If your script accesses other @actions/github internals beyond the standard github/octokit client, you may need to update those references for v9 compatibility.

What's Changed

• Add ACTIONS_ORCHESTRATION_ID to user-agent string by @​Copilot in actions/github-script#695
• ci: use deployment: false for integration test environments by @​salmanmkc in actions/github-script#712
• feat!: add getOctokit to script context, upgrade @​actions/github v9, @​octokit/core v7, and related packages by @​salmanmkc in actions/github-script#700

New Contributors

• @​Copilot made their first contribution in actions/github-script#695

Full Changelog: actions/github-script@v8.0.0...v9.0.0

Commits

• 3a2844b Merge pull request #700 from actions/salmanmkc/expose-getoctokit + prepare re...
• ca10bbd fix: use @​octokit/core/types import for v7 compatibility
• 86e48e2 merge: incorporate main branch changes
• c108472 chore: rebuild dist for v9 upgrade and getOctokit factory
• afff112 Merge pull request #712 from actions/salmanmkc/deployment-false + fix user-ag...
• ff8117e ci: fix user-agent test to handle orchestration ID
• 81c6b78 ci: use deployment: false to suppress deployment noise from integration tests
• 3953caf docs: update README examples from @​v8 to @​v9, add getOctokit docs and v9 brea...
• c17d55b ci: add getOctokit integration test job
• a047196 test: add getOctokit integration tests via callAsyncFunction
• Additional commits viewable in compare view

[changeset-bot]

⚠️ No Changeset found

Latest commit: dab9a93

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[matt-evervault]

Review summary

Verdict: safe to merge as-is. No code changes pushed.

What changed

Bumps actions/github-script from v8 to v9 in 4 workflow steps:

• .github/workflows/publish-static-bundle.yml (3 steps)
• .github/workflows/release.yml (1 step)

Relevant v9 breaking changes

1. require('@actions/github') no longer works (v9 is ESM-only).
2. getOctokit is now an injected script-context function — declaring const getOctokit = ... or let getOctokit = ... produces a SyntaxError.
3. Other non-standard @actions/github internals may need updating.
4. New (additive): ACTIONS_ORCHESTRATION_ID is appended to the user-agent.

Audit of every actions/github-script script body in this repo

Step	Uses	Affected by v9?
publish-static-bundle.yml:76 "Assert preview package"	core.setFailed() only	No
publish-static-bundle.yml:118 "Prepare cloudfront payload" (preview)	Pure JS string/array, returns object	No
publish-static-bundle.yml:230 "Prepare cloudfront payload" (live)	Pure JS string/array, returns object	No
release.yml:22 "get-package-name"	process.env.RELEASE_TAG + string slicing	No

None of the scripts:

• call require('@actions/github')
• declare const/let getOctokit
• access @actions/github internals
• make any Octokit/API calls (so user-agent changes are irrelevant)

Security / performance

• v9 published by the same official actions/ org as v8.
• Diff is a pure version bump; no script bodies modified.
• No new permissions or secrets required.

CI

All 17 checks on this branch are green.

No edits required — merging this PR is safe.

---

Generated by Claude Code