
Product
Introducing Webhook Events for Alert Changes
Add real-time Socket webhook events to your workflows to automatically receive software supply chain alert changes in real time.
@actions/github
Advanced tools
@actions/githubA hydrated Octokit client.
Returns an authenticated Octokit client that follows the machine proxy settings and correctly sets GHES base urls. See https://octokit.github.io/rest.js for the API.
const github = require('@actions/github');
const core = require('@actions/core');
async function run() {
// This should be a token with access to your repository scoped in as a secret.
// The YML workflow will need to set myToken with the GitHub Secret Token
// myToken: ${{ secrets.GITHUB_TOKEN }}
// https://help.github.com/en/actions/automating-your-workflow-with-github-actions/authenticating-with-the-github_token#about-the-github_token-secret
const myToken = core.getInput('myToken');
const octokit = github.getOctokit(myToken)
// You can also pass in additional options as a second parameter to getOctokit
// const octokit = github.getOctokit(myToken, {userAgent: "MyActionVersion1"});
const { data: pullRequest } = await octokit.rest.pulls.get({
owner: 'octokit',
repo: 'rest.js',
pull_number: 123,
mediaType: {
format: 'diff'
}
});
console.log(pullRequest);
}
run();
You can also make GraphQL requests. See https://github.com/octokit/graphql.js for the API.
const result = await octokit.graphql(query, variables);
Finally, you can get the context of the current action:
const github = require('@actions/github');
const context = github.context;
const newIssue = await octokit.rest.issues.create({
...context.repo,
title: 'New issue!',
body: 'Hello Universe!'
});
The npm module @octokit/webhooks-definitions provides type definitions for the response payloads. You can cast the payload to these types for better type information.
First, install the npm module npm install @octokit/webhooks-definitions
Then, assert the type based on the eventName
import * as core from '@actions/core'
import * as github from '@actions/github'
import {PushEvent} from '@octokit/webhooks-definitions/schema'
if (github.context.eventName === 'push') {
const pushPayload = github.context.payload as PushEvent
core.info(`The head commit is: ${pushPayload.head_commit}`)
}
@octokit/core now supports the plugin architecture. You can extend the GitHub instance using plugins.
For example, using the @octokit/plugin-enterprise-server you can now access enterprise admin apis on GHES instances.
import { GitHub, getOctokitOptions } from '@actions/github/lib/utils'
import { enterpriseServer220Admin } from '@octokit/plugin-enterprise-server'
const octokit = GitHub.plugin(enterpriseServer220Admin)
// or override some of the default values as well
// const octokit = GitHub.plugin(enterpriseServer220Admin).defaults({userAgent: "MyNewUserAgent"})
const myToken = core.getInput('myToken');
const myOctokit = new octokit(getOctokitOptions(token))
// Create a new user
myOctokit.rest.enterpriseAdmin.createUser({
login: "testuser",
email: "testuser@test.com",
});
github-api is another JavaScript package that provides an interface to the GitHub API. It offers functionalities similar to @actions/github, such as repository management and issue handling. However, github-api is not specifically tailored for GitHub Actions and might be more suitable for general GitHub API interactions within JavaScript applications. It differs from @actions/github by its broader focus, not being limited to GitHub Actions workflows.
FAQs
Actions github lib
The npm package @actions/github receives a total of 2,020,926 weekly downloads. As such, @actions/github popularity was classified as popular.
We found that @actions/github demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Product
Add real-time Socket webhook events to your workflows to automatically receive software supply chain alert changes in real time.

Security News
ENISA has become a CVE Program Root, giving the EU a central authority for coordinating vulnerability reporting, disclosure, and cross-border response.

Product
Socket now scans OpenVSX extensions, giving teams early detection of risky behaviors, hidden capabilities, and supply chain threats in developer tools.