Upgrade actions/github-script to v8 with Node.js 24 support (#8882)

Author: Copilot

.github/aw/actions-lock.json

@@ -35,11 +35,6 @@
       "version": "v6.0.0",
       "sha": "018cc2cf5baa6db3ef3c5f8a56943fffe632ef53"
     },
-    "actions/github-script@v7.1.0": {
-      "repo": "actions/github-script",
-      "version": "v7.1.0",
-      "sha": "f28e40c7f34bde8b3046d885e986cb6290c5673b"
-    },
     "actions/github-script@v8.0.0": {
       "repo": "actions/github-script",
       "version": "v8.0.0",

.github/workflows/auto-close-parent-issues.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Auto-close parent issues when all sub-issues are closed
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             const { owner, repo } = context.repo;

.github/workflows/install.yml

@@ -176,7 +176,7 @@ jobs:
         uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 
       - name: Create issue on failure
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             const workflowUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;

.github/workflows/shared/ollama-threat-scan.md

@@ -27,7 +27,7 @@ safe-outputs:
     steps:
       - name: Ollama Llama Guard 3 Threat Scan
         id: ollama-scan
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             const fs = require('fs');

docs/workflows/auto-close-parent-issues.md

@@ -152,7 +152,7 @@ The workflow uses **pagination** to handle parents with many sub-issues:
 ## Technical Details
 
 - **Runtime**: ubuntu-latest
-- **Action**: github-script@v7.0.1
+- **Action**: github-script@v8.0.0
 - **Language**: JavaScript
 - **API**: GitHub GraphQL API v4
 

pkg/workflow/action_pins_logging_test.go

@@ -36,9 +36,9 @@ func TestActionPinResolutionWithMismatchedVersions(t *testing.T) {
 			expectMismatch: true,
 		},
 		{
-			name:           "github-script v7.0.1 resolves to v8.0.0 pin (latest version)",
+			name:           "github-script v7 resolves to v8.0.0 pin (latest version)",
 			repo:           "actions/github-script",
-			requestedVer:   "v7.0.1",
+			requestedVer:   "v7",
 			expectedPinVer: "v8.0.0", // Returns latest version for this repo
 			expectMismatch: true,
 		},

pkg/workflow/action_pins_test.go

@@ -347,9 +347,9 @@ func TestApplyActionPinToStep(t *testing.T) {
 func TestGetActionPinsSorting(t *testing.T) {
 	pins := getActionPins()
 
-	// Verify we got all the pins (should be 29 as of this test after deduplication)
-	if len(pins) != 29 {
-		t.Errorf("getActionPins() returned %d pins, expected 29", len(pins))
+	// Verify we got all the pins (should be 28 as of this test after deduplication)
+	if len(pins) != 28 {
+		t.Errorf("getActionPins() returned %d pins, expected 28", len(pins))
 	}
 
 	// Verify they are sorted by version (descending) then by repository name (ascending)

pkg/workflow/action_sha_checker_test.go

@@ -207,7 +207,7 @@ jobs:
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6
-      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
       - name: Run tests
         run: npm test
 `
@@ -240,7 +240,7 @@ jobs:
 	}{
 		{"actions/checkout", "v5"},
 		{"actions/setup-node", "v6"},
-		{"actions/github-script", "v7.0.1"},
+		{"actions/github-script", "v8.0.0"},
 	}
 
 	for _, tt := range tests {

pkg/workflow/data/action_pins.json

@@ -35,11 +35,6 @@
       "version": "v6.0.0",
       "sha": "018cc2cf5baa6db3ef3c5f8a56943fffe632ef53"
     },
-    "actions/github-script@v7.1.0": {
-      "repo": "actions/github-script",
-      "version": "v7.1.0",
-      "sha": "f28e40c7f34bde8b3046d885e986cb6290c5673b"
-    },
     "actions/github-script@v8.0.0": {
       "repo": "actions/github-script",
       "version": "v8.0.0",

specs/actions.md

@@ -384,10 +384,10 @@ outputContent := filesRegex.ReplaceAllString(
 
 ### Decision 5: Node.js 20 Runtime
 
-**Decision**: Use `node20` as the runtime for all actions.
+**Decision**: Use `node24` as the runtime for all actions.
 
 **Rationale**:
-- Latest stable Node.js version supported by GitHub Actions
+- Latest stable Node.js version supported by GitHub Actions (v8.0.0+ of github-script)
 - Modern JavaScript features available
 - Consistent with workflow compilation environment
 
@@ -427,7 +427,7 @@ jobs:
        required: true
        default: '/tmp/my-action'
    runs:
-     using: 'node20'
+     using: 'node24'
      main: 'index.js'
    ```
 
@@ -833,7 +833,7 @@ inputs:
     description: 'Path to agent output JSON file'
     required: true
 runs:
-  using: 'node20'
+  using: 'node24'
   main: 'index.js'
 EOF