[llvm] Update [Github] Update GHA Dependencies (major) (PR #192881)
Mend Renovate via llvm-commits
llvm-commits at lists.llvm.org
Sun Apr 19 17:01:17 PDT 2026
https://github.com/renovate-bot created https://github.com/llvm/llvm-project/pull/192881
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [actions/create-github-app-token](https://redirect.github.com/actions/create-github-app-token) | action | major | `v2.2.1` → `v3.1.1` |
| [actions/github-script](https://redirect.github.com/actions/github-script) | action | major | `v8.0.0` → `v9.0.0` |
---
> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/160328) for more information.
---
### Release Notes
<details>
<summary>actions/create-github-app-token (actions/create-github-app-token)</summary>
### [`v3.1.1`](https://redirect.github.com/actions/create-github-app-token/releases/tag/v3.1.1)
[Compare Source](https://redirect.github.com/actions/create-github-app-token/compare/v3.1.0...v3.1.1)
##### Bug Fixes
- improve error message when app identifier is empty ([#362](https://redirect.github.com/actions/create-github-app-token/issues/362)) ([07e2b76](https://redirect.github.com/actions/create-github-app-token/commit/07e2b760664f080c40eec4eacf7477256582db36)), closes [#249](https://redirect.github.com/actions/create-github-app-token/issues/249)
### [`v3.1.0`](https://redirect.github.com/actions/create-github-app-token/releases/tag/v3.1.0)
[Compare Source](https://redirect.github.com/actions/create-github-app-token/compare/v3.0.0...v3.1.0)
##### Bug Fixes
- **deps:** bump p-retry from 7.1.1 to 8.0.0 ([#357](https://redirect.github.com/actions/create-github-app-token/issues/357)) ([3bbe07d](https://redirect.github.com/actions/create-github-app-token/commit/3bbe07d928e2d6c30bf3e37c6b89edbc4045facf))
##### Features
- add `client-id` input and deprecate `app-id` ([#353](https://redirect.github.com/actions/create-github-app-token/issues/353)) ([e6bd4e6](https://redirect.github.com/actions/create-github-app-token/commit/e6bd4e6970172bed9fe138b2eaf4cbffa4cca8f9))
- update permission inputs ([#358](https://redirect.github.com/actions/create-github-app-token/issues/358)) ([076e948](https://redirect.github.com/actions/create-github-app-token/commit/076e9480ca6e9633bff412d05eff0fc2f1e7d2be))
### [`v3.0.0`](https://redirect.github.com/actions/create-github-app-token/releases/tag/v3.0.0)
[Compare Source](https://redirect.github.com/actions/create-github-app-token/compare/v2.2.2...v3.0.0)
- feat!: node 24 support ([#275](https://redirect.github.com/actions/create-github-app-token/issues/275)) ([2e564a0](https://redirect.github.com/actions/create-github-app-token/commit/2e564a0bb8e7cc2b907b2401a2afe177882d4325))
- fix!: require `NODE_USE_ENV_PROXY` for proxy support ([#342](https://redirect.github.com/actions/create-github-app-token/issues/342)) ([4451bcb](https://redirect.github.com/actions/create-github-app-token/commit/4451bcbc139f8124b0bf04f968ea2586b17df458))
##### Bug Fixes
- remove custom proxy handling ([#143](https://redirect.github.com/actions/create-github-app-token/issues/143)) ([dce0ab0](https://redirect.github.com/actions/create-github-app-token/commit/dce0ab05f36f30b22fd14289fd36655c618e4e8e))
##### BREAKING CHANGES
- Custom proxy handling has been removed. If you use HTTP\_PROXY or HTTPS\_PROXY, you must now also set NODE\_USE\_ENV\_PROXY=1 on the action step.
- Requires [Actions Runner v2.327.1](https://redirect.github.com/actions/runner/releases/tag/v2.327.1) or later if you are using a self-hosted runner.
### [`v2.2.2`](https://redirect.github.com/actions/create-github-app-token/releases/tag/v2.2.2)
[Compare Source](https://redirect.github.com/actions/create-github-app-token/compare/v2.2.1...v2.2.2)
##### Bug Fixes
- **deps:** bump [@actions/core](https://redirect.github.com/actions/core) from 1.11.1 to 3.0.0 ([#337](https://redirect.github.com/actions/create-github-app-token/issues/337)) ([b044133](https://redirect.github.com/actions/create-github-app-token/commit/b04413352d4644ac2131b9a90c074f5e93ca18a1))
- **deps:** bump minimatch from 9.0.5 to 9.0.9 ([#335](https://redirect.github.com/actions/create-github-app-token/issues/335)) ([5cbc656](https://redirect.github.com/actions/create-github-app-token/commit/5cbc65624c9ddc4589492bda7c8b146223e8c3e4))
- **deps:** bump the production-dependencies group with 4 updates ([#336](https://redirect.github.com/actions/create-github-app-token/issues/336)) ([6bda5bc](https://redirect.github.com/actions/create-github-app-token/commit/6bda5bc1410576b9a0879ce6076d53345485bba9))
- **deps:** bump undici from 7.16.0 to 7.18.2 ([#323](https://redirect.github.com/actions/create-github-app-token/issues/323)) ([b4f638f](https://redirect.github.com/actions/create-github-app-token/commit/b4f638f48ee0dcdbb0bc646c48e4cb2a2de847fe))
</details>
<details>
<summary>actions/github-script (actions/github-script)</summary>
### [`v9.0.0`](https://redirect.github.com/actions/github-script/releases/tag/v9.0.0)
[Compare Source](https://redirect.github.com/actions/github-script/compare/v8.0.0...v9.0.0)
**New features:**
- **`getOctokit` factory function** — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See [Creating additional clients with `getOctokit`](https://redirect.github.com/actions/github-script#creating-additional-clients-with-getoctokit) for details and examples.
- **Orchestration ID in user-agent** — The `ACTIONS_ORCHESTRATION_ID` environment variable is automatically appended to the user-agent string for request tracing.
**Breaking changes:**
- **`require('@actions/github')` no longer works in scripts.** The upgrade to `@actions/github` v9 (ESM-only) means `require('@actions/github')` will fail at runtime. If you previously used patterns like `const { getOctokit } = require('@actions/github')` to create secondary clients, use the new injected `getOctokit` function instead — it's available directly in the script context with no imports needed.
- `getOctokit` is now an injected function parameter. Scripts that declare `const getOctokit = ...` or `let getOctokit = ...` will get a `SyntaxError` because JavaScript does not allow `const`/`let` redeclaration of function parameters. Use the injected `getOctokit` directly, or use `var getOctokit = ...` if you need to redeclare it.
- If your script accesses other `@actions/github` internals beyond the standard `github`/`octokit` client, you may need to update those references for v9 compatibility.
##### What's Changed
- Add ACTIONS\_ORCHESTRATION\_ID to user-agent string by [@Copilot](https://redirect.github.com/Copilot) in [#695](https://redirect.github.com/actions/github-script/pull/695)
- ci: use deployment: false for integration test environments by [@salmanmkc](https://redirect.github.com/salmanmkc) in [#712](https://redirect.github.com/actions/github-script/pull/712)
- feat!: add getOctokit to script context, upgrade [@actions/github](https://redirect.github.com/actions/github) v9, [@octokit/core](https://redirect.github.com/octokit/core) v7, and related packages by [@salmanmkc](https://redirect.github.com/salmanmkc) in [#700](https://redirect.github.com/actions/github-script/pull/700)
##### New Contributors
- [@Copilot](https://redirect.github.com/Copilot) made their first contribution in [#695](https://redirect.github.com/actions/github-script/pull/695)
**Full Changelog**: <https://github.com/actions/github-script/compare/v8.0.0...v9.0.0>
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- Between 12:00 AM and 12:59 AM, only on Monday (`* 0 * * 1`)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/llvm/llvm-project).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMjMuOCIsInVwZGF0ZWRJblZlciI6IjQzLjEyMy44IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
>From 9c33c262bbf6a341a7b83e8363a1076472ad7137 Mon Sep 17 00:00:00 2001
From: Mend Renovate <bot at renovateapp.com>
Date: Mon, 20 Apr 2026 00:00:39 +0000
Subject: [PATCH] Update [Github] Update GHA Dependencies
---
.github/workflows/commit-access-review.yml | 2 +-
.github/workflows/issue-write.yml | 2 +-
.github/workflows/llvm-bugs.yml | 2 +-
.github/workflows/release-asset-audit.yml | 2 +-
.github/workflows/unprivileged-download-artifact/action.yml | 2 +-
5 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/.github/workflows/commit-access-review.yml b/.github/workflows/commit-access-review.yml
index 8c89e99a3050c..5bbc80c4107a8 100644
--- a/.github/workflows/commit-access-review.yml
+++ b/.github/workflows/commit-access-review.yml
@@ -26,7 +26,7 @@ jobs:
pip install --require-hashes -r ./llvm/utils/git/requirements.txt
- id: app-token
- uses: actions/create-github-app-token at 29824e69f54612133e76f7eaac726eef6c875baf #v2.2.1
+ uses: actions/create-github-app-token at 1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
with:
app-id: ${{ secrets.LLVM_TOKEN_GENERATOR_CLIENT_ID }}
private-key: ${{ secrets.LLVM_TOKEN_GENERATOR_PRIVATE_KEY }}
diff --git a/.github/workflows/issue-write.yml b/.github/workflows/issue-write.yml
index db378e286932d..cc1e36c696e69 100644
--- a/.github/workflows/issue-write.yml
+++ b/.github/workflows/issue-write.yml
@@ -44,7 +44,7 @@ jobs:
- name: 'Comment on PR'
if: steps.download-artifact.outputs.artifact-ids != ''
- uses: actions/github-script at ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+ uses: actions/github-script at 3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
diff --git a/.github/workflows/llvm-bugs.yml b/.github/workflows/llvm-bugs.yml
index 627b5e48da2b6..a85008e44bc22 100644
--- a/.github/workflows/llvm-bugs.yml
+++ b/.github/workflows/llvm-bugs.yml
@@ -20,7 +20,7 @@ jobs:
check-latest: true
- run: npm install mailgun.js form-data
- name: Send notification
- uses: actions/github-script at ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+ uses: actions/github-script at 3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
env:
MAILGUN_API_KEY: ${{ secrets.LLVM_BUGS_KEY }}
with:
diff --git a/.github/workflows/release-asset-audit.yml b/.github/workflows/release-asset-audit.yml
index 08d0106664b7d..8924ccc134289 100644
--- a/.github/workflows/release-asset-audit.yml
+++ b/.github/workflows/release-asset-audit.yml
@@ -59,7 +59,7 @@ jobs:
with:
name: comment
- name: "File Issue"
- uses: actions/github-script at ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+ uses: actions/github-script at 3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
github-token: ${{ secrets.ISSUE_SUBSCRIBER_TOKEN }}
script: |
diff --git a/.github/workflows/unprivileged-download-artifact/action.yml b/.github/workflows/unprivileged-download-artifact/action.yml
index 173b8ca93252f..6dc12588ef81c 100644
--- a/.github/workflows/unprivileged-download-artifact/action.yml
+++ b/.github/workflows/unprivileged-download-artifact/action.yml
@@ -27,7 +27,7 @@ outputs:
runs:
using: "composite"
steps:
- - uses: actions/github-script at ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+ - uses: actions/github-script at 3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
id: artifact-url
with:
script: |
More information about the llvm-commits
mailing list