chore(deps): bump @actions/github from 6.0.0 to 9.1.1

[dependabot]

Bumps @actions/github from 6.0.0 to 9.1.1.

Changelog

Sourced from @​actions/github's changelog.

9.1.1

• Bump undici from 6.23.0 to 6.24.0 #2346

9.1.0

• Append actions_orchestration_id to user-agent when the ACTIONS_ORCHESTRATION_ID environment variable is set #2364

9.0.0

• Breaking change: Package is now ESM-only
  • CommonJS consumers must use dynamic import() instead of require()
  • Example: const { getOctokit, context } = await import('@actions/github')
• Fix TypeScript compilation by migrating to ESM, enabling proper imports from @octokit/core/types

8.0.1

• Update undici to 6.23.0
• Update @actions/http-client to 3.0.2

8.0.0

• Update @​octokit dependencies
  • @octokit/core ^7.0.6
  • @octokit/plugin-paginate-rest ^14.0.0
  • @octokit/plugin-rest-endpoint-methods ^17.0.0
  • @octokit/request ^10.0.7
  • @octokit/request-error ^7.1.0
• Breaking change: Minimum Node.js version is now 20 (previously 18)

7.0.0

• Update to v3.0.1 of @actions/http-client

6.0.1

• Dependency updates #2043
• Add context.runAttempt #1588

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​actions/github since your current version.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 5e002f2

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​actions/​github@​9.1.1

View full report

[ev-vaultkeeper]

Dependabot review: @actions/github 6.0.0 → 9.1.1

TL;DR — safe to merge (CI green, no regression of any currently-working path), but with an important caveat: the upgraded package is ESM-only and cannot actually be loaded by its sole consumer's build output. That consumer is already broken for the same reason on master, so this bump doesn't change observable behaviour.

Where it's used

The only consumer in the repo is the actions/revert-deploy action (@ev/revert-s3-deploy):

• actions/revert-deploy/src/index.ts → import { getOctokit } from "@actions/github", plus octokit.rest.repos.listReleases / updateRelease.
• It also imports @actions/core.

The API surface it uses (getOctokit, context, rest.repos.listReleases, rest.repos.updateRelease) is all still present in 9.1.1, so nothing was renamed/removed out from under the code.

The concern: ESM-only migration (changelog v9.0.0)

@actions/github@9.1.1 is now ESM-only ("type": "module", exports exposes only an import condition — no require/default). This action builds with tsup format: ["cjs"] + skipNodeModulesBundle: true and tsconfig module: CommonJS, so the emitted dist/index.js contains require('@actions/github'). That require() fails at runtime with ERR_PACKAGE_PATH_NOT_EXPORTED on every Node version (Node's require(esm) support does not apply here, because require() resolution never matches the import export condition — verified on Node 22 and with a minimal repro).

Why this is not a regression

@actions/core@3.0.x (already on master, unchanged by this PR) is also ESM-only with the same exports shape, and it is require()d first (line 3 of the bundle, before @actions/github on line 4). So on master the action already crashes at load with ERR_PACKAGE_PATH_NOT_EXPORTED for @actions/core. The base version @actions/github@6.0.0 was CommonJS (require-able) but is never reached. After this PR both requires fail, but the crash point is unchanged. In short: the revert-deploy action is non-functional at runtime both before and after this PR.

Build / CI

• pnpm --filter @ev/revert-s3-deploy... build (used by revert-release.yml) passes — tsup/esbuild does no type-checking and doesn't execute the code, so the ESM/CJS mismatch is invisible at build time. I made no code changes.
• CI is green because the Typescript check / eslint steps filter to @evervault/* packages, so this @ev/* action's tsc is never run.

Security / perf

Nothing suspicious. undici is bumped to 6.24.0 (consistent with the repo's existing undici override); the repo also pins @actions/http-client to 4.0.0 via pnpm.overrides.

Recommendation

Merging is fine (no working path breaks, CI passes). But if the team wants the revert-deploy action to actually run, the build needs fixing independently of this bump: bundle node_modules (drop skipNodeModulesBundle, à la @vercel/ncc) or emit ESM (type: module / .mjs), which would resolve both @actions/core and @actions/github. Separately, src/index.ts:223 references github.context but only getOctokit is imported (github is undefined) — a pre-existing ReferenceError/TS2304 unrelated to this PR that would surface once the module-loading issue is fixed.

[ev-vaultkeeper]

@actions/github 9.x is ESM-only (breaking change in v9.0.0). The only consumer, actions/revert-deploy, builds to CommonJS with skipNodeModulesBundle: true, so its dist/index.js emits require('@actions/github') — which fails at runtime with ERR_PACKAGE_PATH_NOT_EXPORTED.

This is not a regression: @actions/core@3.0.x (already present) is ESM-only too and is required first, so the action already fails to load on master. If this action is meant to run, the build should bundle deps (or emit ESM) to fix both.