build(deps): bump actions/github-script from 8.0.0 to 9.0.0

[dependabot]

Update the pinned GitHub Script action from v8 to v9.0.0 for the release version preflight. The upstream annotated tag peels to 3a2844b7e9c422d3c10d287c895573f7108da1b3, matching this PR.

The existing script loads the local CommonJS preflight helper and uses the injected github and context objects. It does not import @actions/github or redeclare getOctokit, so it avoids the documented v9 breaking changes. The action continues to use Node 24.

Validation:

• Independently inspected the pinned action manifest, script-context construction, CommonJS require wrapper, and bundled implementation.
• Executed the actual pinned dist/index.js bundle on Node 24 with the unchanged crawlkit preflight and a synthetic local HTTP server. An unused version passed; existing tag, existing release, HTTP 500 and HTTP 401 each failed closed. All five cases made only the expected read requests. No release workflow was dispatched.
• All 25 repository release guard tests passed. make check, uncached full Go tests and a built temporary-config crawlctl smoke also passed on the same main code.
• Independent Codex autoreview of this exact commit reported no actionable P0–P2 findings.
• PR CI, Windows tests, CodeQL and secret scanning passed at 53edbd471b924d13f5f1fde4d2b06677b48d7dc9.

Credit: @dependabot. Prepared for maintainer review.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 4, 2026, 4:52 AM ET / 08:52 UTC.

ClawSweeper review

What this changes

Updates the pinned GitHub Script action to v9.0.0 for the release workflow’s unused-version check.

Merge readiness

✅ Ready for maintainer review

The update remains useful: reviewed main and v0.14.8 still use v8. No actionable patch defect was found, and the updated discussion addresses the earlier compatibility concern with reported bundle-level validation.

Priority: P3
Reviewed head: 53edbd471b924d13f5f1fde4d2b06677b48d7dc9

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused dependency update with relevant reported validation and no actionable correctness finding.
Proof confidence	🌊 off-meta tidepool	Not applicable: This bot-authored update is exempt from contributor proof requirements; the captured body additionally reports the pinned action bundle executing the real preflight on Node 24, allowing an unused version and rejecting existing versions and API failures.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This bot-authored update is exempt from contributor proof requirements; the captured body additionally reports the pinned action bundle executing the real preflight on Node 24, allowing an unused version and rejecting existing versions and API failures.
Evidence reviewed	10 items	Exact introduced change: The pinned base-to-head comparison changes one action reference and nothing else; script input, permissions, concurrency, publication dependency, and secret placement remain unchanged. Current-main necessity: Reviewed main still pins actions/github-script to ed597411d8f924073f98dfc5c65a23a2325f34cd, identified as v8. Latest release comparison: The v0.14.8 workflow also uses v8; its tag resolves to the supplied release commit.
Findings	None	None.
Security	None	None.

How this fits together

Crawlkit’s release preflight receives a requested version and checks GitHub for an existing tag or release. Only a successful check allows the shared signing and publication workflow to run.

flowchart TD
  A[Requested release version] --> B[Validate and normalize version]
  B --> C[GitHub Script action]
  C --> D[Read tag and release state]
  D --> E{Version unused?}
  E -->|Yes| F[Shared release pipeline]
  E -->|No or API failure| G[Stop release]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

None.

Technical review

Best possible solution:

Keep the dependency current while preserving the read-only preflight and existing publication gate.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this dependency update does not report a broken existing behavior, and source review found no introduced defect.

Is this the best way to solve the issue?

Yes: changing the existing immutable action pin is the narrowest update, and the unchanged caller avoids the v9 incompatibilities described in the captured PR body.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against c778575cf46a.

Labels

Label justifications:

• P3: This is routine release-tooling dependency maintenance with no established user-facing regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This bot-authored update is exempt from contributor proof requirements; the captured body additionally reports the pinned action bundle executing the real preflight on Node 24, allowing an unused version and rejecting existing versions and API failures.

Evidence

What I checked:

• Exact introduced change: The pinned base-to-head comparison changes one action reference and nothing else; script input, permissions, concurrency, publication dependency, and secret placement remain unchanged. (.github/workflows/release-unified.yml:28, 53edbd471b92)
• Current-main necessity: Reviewed main still pins actions/github-script to ed597411d8f924073f98dfc5c65a23a2325f34cd, identified as v8. (.github/workflows/release-unified.yml:28, c778575cf46a)
• Latest release comparison: The v0.14.8 workflow also uses v8; its tag resolves to the supplied release commit. (.github/workflows/release-unified.yml:28, 5cdee495743f)
• Action compatibility and security boundary: The workflow directly executes the updated dependency, loads a local CommonJS helper, and uses injected github/context values. Preflight receives contents:read, while signing secrets belong to the separate release job. (.github/workflows/release-unified.yml:33, 53edbd471b92)
• Existing release-guard contract: The helper makes tag and release read requests, accepts only HTTP 404 as absence, and propagates other failures. The complete test file covers unused versions, existing versions, API errors, invalid input, and workflow gating. (.github/scripts/release-preflight.cjs:7, 53edbd471b92)
• Updated validation report and review continuity: The complete captured PR body reports executing the exact pinned bundle on Node 24 against a local HTTP server: unused version passed, existing tag/release and HTTP 500/401 failed closed, with only expected reads. It also reports upstream source inspection and 25 passing guard tests. These are submitted validation claims, not commands executed during this review. The prior review had no findings or published rank-up moves. (53edbd471b92)

Likely related people:

• Peter Steinberger: Raw commit 52f0fb1 adds .github/scripts/release-preflight.cjs:1 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 52f0fb12e4d2; files: .github/scripts/release-preflight.cjs)
• openclaw/openclaw-secops: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)

• reviewed 2026-09-04T07:29:22.335Z sha 53edbd4 :: blocked before merge. :: none