Conversation
Moves the three `actions/github-script` steps in `_claude-code.yml` from `v7` to `v9`. v7 is two majors behind and pins the action to the Node 20 runtime, which GitHub is winding down. `.github/actions/cross-repo-ci-relay-callback/action.yml` is the repo's only other call site and is already being moved to v9 by pytorch#8675, so it is left alone here to avoid a conflict. After both land, no `@v7` references remain. ## Breaking-change review Checked every documented breakage against the three scripts. None apply. **v8.0.0** — Node runtime moved to 24.x. Requires runner **v2.327.1** or newer. This is the only real constraint; these steps run on the standard hosted/self- hosted pool rather than any special-cased runner. **v9.0.0** — three script-level breakages, all in `@actions/github` v9 becoming ESM-only: - `require('@actions/github')` fails at runtime - `getOctokit` is now an injected function parameter, so a script declaring `const getOctokit = ...` or `let getOctokit = ...` raises `SyntaxError` - other `@actions/github` internals may need updating All three scripts use only the injected `github.rest.*`, `context.*` and `core.*` surface, which is unchanged across v7 -> v9. Repo-wide there are no occurrences of `require('@actions/github')`, `const getOctokit` or `let getOctokit` under `.github/`. The `getOctokit` matches elsewhere in the tree are inside vendored `dist/` bundles of unrelated actions (`checkout`, `setup-ssh`, `upload-artifact-s3`), not github-script scripts. Kept as the floating `@v9` tag to match how the other call sites reference this action; SHA-pinning all of them is worth doing separately rather than introducing a second convention in one file. Test Plan: - Diff is three `uses:` lines; no script bodies changed: `- uses: actions/github-script@v7` `+ uses: actions/github-script@v9` (x3) - Verified the only remaining `@v7` in the repo is the one pytorch#8675 already covers. - The scripts exercise `github.rest.repos.getCollaboratorPermissionLevel`, `github.rest.pulls.get`, `github.rest.users.getByUsername`, plus `core.setOutput` / `core.setFailed` / `core.exportVariable` and `context.repo` / `context.payload` / `context.actor` -- all stable in v9. - `_claude-code.yml` is a `workflow_call` reusable workflow triggered by `@claude` mentions, so it is not exercised by PR CI; first real run is the next Claude Code invocation.
|
@atalman is attempting to deploy a commit to the Meta Open Source Team on Vercel. A member of the Team first needs to authorize it. |
meta-cla
Bot
added
the
CLA Signed
atalman
changed the title
actions/github-script to v9 in _claude-code.ymlactions/github-script to v9 in _claude-code.yml
georgehong
approved these changes
Sep 1, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moves the three
actions/github-scriptsteps in.github/workflows/_claude-code.ymlfromv7tov9. v7 is two majors behind and pins the action to the Node 20 runtime, which GitHub is winding down..github/actions/cross-repo-ci-relay-callback/action.ymlis the repo's only other call site and is already being moved to v9 by #8675, so it is left alone here to avoid a conflict. Once both land, no@v7references remain.Breaking-change review
Checked every documented breakage against the three scripts. None apply.
v8.0.0 — Node runtime moved to 24.x, with a hard floor of runner v2.327.1. This is the only real constraint; these steps run on the standard pool.
v9.0.0 — three script-level breakages, all stemming from
@actions/githubv9 becoming ESM-only:require('@actions/github')fails at runtimegetOctokitis now an injected function parameter, so a script declaringconst getOctokit = ...orlet getOctokit = ...raisesSyntaxError@actions/githubinternals may need updatingAll three scripts use only the injected
github.rest.*,context.*andcore.*surface, unchanged across v7 → v9. Repo-wide there are no occurrences ofrequire('@actions/github'),const getOctokitorlet getOctokitunder.github/. ThegetOctokitmatches elsewhere in the tree are inside vendoreddist/bundles of unrelated actions (checkout,setup-ssh,upload-artifact-s3), not github-script scripts.Kept as the floating
@v9tag to match how the other call sites reference this action. SHA-pinning all of them is worth doing separately rather than introducing a second convention in one file.Test plan
uses:lines; no script bodies changed.@v7in the repo is the one add retry mechanism for getting OIDC token #8675 already covers.github.rest.repos.getCollaboratorPermissionLevel,github.rest.pulls.get,github.rest.users.getByUsername, pluscore.setOutput/core.setFailed/core.exportVariableandcontext.repo/context.payload/context.actor— all stable in v9._claude-code.ymlis aworkflow_callreusable workflow triggered by@claudementions, so PR CI does not exercise it; the first real run is the next Claude Code invocation.