What this does

Upgrades @actions/github to v9 (and related Octokit packages) and adds getOctokit to the script context.

Today, if you need a second Octokit client with a different token (GitHub App, PAT, cross-org), you do something like:

const { getOctokit } = require('@actions/github')
const appClient = getOctokit(process.env.APP_TOKEN)

That breaks in v9 because @actions/github is now ESM-only — require() no longer works. This PR replaces that pattern with a built-in getOctokit that's available directly in the script context, no imports needed:

- uses: actions/github-script@v9
  env:
    APP_TOKEN: ${{ secrets.MY_APP_TOKEN }}
  with:
    script: |
      // primary client uses GITHUB_TOKEN as usual
      await github.rest.issues.addLabels({
        issue_number: context.issue.number,
        owner: context.repo.owner,
        repo: context.repo.repo,
        labels: ['needs-review']
      })

      // secondary client uses a different token
      const appOctokit = getOctokit(process.env.APP_TOKEN)
      await appOctokit.rest.repos.createDispatchEvent({
        owner: 'my-org', repo: 'deploy', event_type: 'go'
      })

Works for GHES too:

const ghes = getOctokit(process.env.GHES_TOKEN, {
  baseUrl: 'https://github.example.com/api/v3'
})

The secondary client inherits retry settings, user-agent, proxy config, and plugins from the action — so it behaves consistently with the primary github client. request and retry options are deep-merged (so you can tweak one field without losing the rest), while other options like baseUrl or userAgent replace the default outright if you set them.

Dependency upgrades

Also updated tsconfig.json to ES2022 with bundler module resolution, and added Jest tsconfig overrides for CJS test compatibility.

Why v9

@actions/github v6 → v9 brings updated Octokit types and the orchestration ID user-agent feature (toolkit#2364). The main breaking change is that require('@actions/github') stops working inside scripts — workflows like MetaMask's that use this pattern will need to switch to the injected getOctokit instead.

Other breaking changes:

• const getOctokit = ... or let getOctokit = ... in scripts will SyntaxError (same as const github = ... today — function parameters can't be redeclared with const/let). Use it directly or use var if you really need to redeclare.
• Internal @actions/github imports (like @actions/github/lib/utils) may have changed paths.

What's in the diff

New:

• src/create-configured-getoctokit.ts — factory wrapper (deep merge, undefined stripping, plugin dedup)
• Tests: 16 factory unit tests, 4 integration tests, CI workflow job with real API calls

Changed:

• src/main.ts — wires factory into script context
• src/async-function.ts — v9 type imports, getOctokit in argument types
• src/retry-options.ts — updated import path for v9
• tsconfig.json — ES2022 + bundler resolution
• package.json — version 9.0.0, dependency bumps
• .github/workflows/integration.yml — new getOctokit test job, user-agent test fix
• README.md — v9 docs, getOctokit section with examples, breaking changes
• .licenses/ — refreshed for all upgraded packages

Testing

• 35 tests across 4 suites, all green
• 15/15 CI checks passing
• Live demo — real multi-token workflow reading a private repo via SECOND_PAT, GraphQL queries, cross-identity verification

Note: This PR also includes release prep (version bump to 9.0.0, README examples updated to @v9, V9 breaking changes section, license cache refresh). This can be split into a separate PR if preferred.

Part of https://github.com/github/c2c-actions/issues/10001
Also closes: #707