fix(deps): update module github.com/google/go-github/v88 to v90

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/google/go-github/v88	v88.0.0 → v90.0.0

---

Release Notes

google/go-github (github.com/google/go-github/v88)

v90.0.0

Compare Source

This release contains the following breaking API changes:

• refactor!: Pass UpdateConnectedExternalGroup request body by value via new UpdateConnectedExternalGroupRequest (#​4425)
  BREAKING CHANGE: TeamsService.UpdateConnectedExternalGroup now takes UpdateConnectedExternalGroupRequest (with non-pointer GroupID) by value.
• refactor!: Rename PullRequestReviewDismissalRequest to PullRequestDismissReviewRequest, add PullRequestSubmitReviewRequest, and pass review request bodies by value (#​4406)
  BREAKING CHANGE: PullRequestReviewDismissalRequest is now PullRequestDismissReviewRequest with non-pointer Message and PullRequestsService.DismissReview takes it by value; PullRequestsService.SubmitReview now takes a new PullRequestSubmitReviewRequest.
• refactor!: Split CreateOrUpdateCustomRepoRoleOptions into CreateCustomRepoRoleRequest and UpdateCustomRepoRoleRequest and pass by value (#​4401)
  BREAKING CHANGE: CreateOrUpdateCustomRepoRoleOptions is split into CreateCustomRepoRoleRequest (with non-pointer Name and BaseRole) and UpdateCustomRepoRoleRequest; OrganizationsService.CreateCustomRepoRole and UpdateCustomRepoRole now take these request types by value.
• refactor!: Rename EditLabel to UpdateLabel, Split Label into CreateLabelRequest & UpdateLabelRequest and pass by value (#​4400)
  BREAKING CHANGE: IssuesService.CreateLabel now takes CreateLabelRequest by value (with required non-pointer Name); IssuesService.EditLabel renamed to UpdateLabel, taking an UpdateLabelRequest by value.
• refactor!: Rename AutolinkOptions to CreateAutolinkRequest, AddAutolink to CreateAutolink, and pass the body by value (#​4399)
  BREAKING CHANGE: AutolinkOptions is now CreateAutolinkRequest with non-pointer KeyPrefix and URLTemplate; RepositoriesService.AddAutolink is now CreateAutolink and passes body by value.
• refactor!: Split IssueRequest into CreateIssueRequest & UpdateIssueRequest and pass by value (#​4396)
  BREAKING CHANGE: IssueService.Edit is renamed to IssueService.Update.
• refactor!: Rename NewPullRequest to CreatePullRequest and pass it by value (#​4395)
  BREAKING CHANGE: NewPullRequest is renamed to CreatePullRequest, PullRequests.Create now takes it by value, and CreatePullRequest.Head and CreatePullRequest.Base are now string.
• refactor!: Pass SarifAnalysis by value (#​4394)
  BREAKING CHANGE: CodeScanningService.UploadSarif now takes body by value and its required fields are no longer pointers.
• refactor!: Pass CreateDeploymentBranchPolicyRequest and UpdateDeploymentBranchPolicyRequest by value (#​4382)
  BREAKING CHANGE: RepositoriesService.CreateDeploymentBranchPolicy and UpdateDeploymentBranchPolicy now take body by value and the required Name field is of type string.
• refactor!: Pass TemplateRepoRequest by value in Repositories.CreateFromTemplate (#​4378)
  BREAKING CHANGE: RepositoriesService.CreateFromTemplate now passes body by value and Name is now required and passed by value.
• refactor!: Pass RepositoryMergeRequest and RepoMergeUpstreamRequest by value (#​4372)
  BREAKING CHANGE: RepositoriesService.Merge and RepositoriesService.MergeUpstream now pass body by value and required struct fields are now values.
• feat!: Refactor dependabot secrets to pass request by value (#​4348)
  BREAKING CHANGE: DependabotService methods involving secrets have new params and return values.

...and the following additional changes:

• chore: Bump version of go-github to v90.0.0 (#​4428)
• docs: Clarify assisted contribution expectations (#​4427)
• feat: Add org level secret scanning custom patterns support (#​4426)
• feat: Add MetaService.ListAPIVersions (#​4422)
• feat: Add DeleteCodeQLDatabase for code scanning (#​4421)
• feat: Add Stack field to PullRequest for stacked pull requests (#​4423)
• build: Bump GitHub workflow action versions (#​4424)
• feat: Add search_type support to issue search (#​4414)
• chore: Update SecurityAdvisory structs with new fields (#​4413)
• chore: Consolidate Dependabot PRs (#​4418)
• feat: Support OIDC custom property claims for Actions (#​4411)
• feat: Add repo-level secret scanning custom patterns support (#​4397)
• chore: Update openapi_operations.yaml (#​4412)
• chore: Fix comment typo (#​4410)
• chore: Update dependabot changes (#​4405)
• chore: Update openapi_operations.yaml (#​4398)
• feat: Add remaining Projects v2 endpoints (#​4319)
• chore: Update Dependabot-driven dependencies (#​4393)
• chore: Bump /example dependencies (#​4380)
• chore: Fix flaky tests with deterministic runs (#​4377)
• build(deps): Bump golang.org/x/sync from 0.21.0 to 0.22.0 in /tools (#​4376)
• chore: Fix flaky unit test (#​4374)
• fix: Enable submitting empty allowlist for actions permissions patterns (#​4371)
• feat: Add GitHub App Enterprise perm scope (#​4343)
• chore: Bump go-github from v88 to v89 in /scrape (#​4370)

v89.0.0

Compare Source

This release contains the following breaking API changes:

• refactor!: Pass DeploymentRequest and DeploymentStatusRequest by value (#​4361)
  BREAKING CHANGE: CreateDeployment and CreateDeploymentStatus now take DeploymentRequest and DeploymentStatusRequest by value; DeploymentRequest.Ref and DeploymentStatusRequest.State are now string, and DeploymentRequest.RequiredContexts is now []string.
• refactor!: Pass HookConfig by value and rename EditHookConfiguration to UpdateHookConfiguration (#​4360)
  BREAKING CHANGE: EditHookConfiguration is renamed to UpdateHookConfiguration on RepositoriesService and OrganizationsService; these methods and AppsService.UpdateHookConfig now take HookConfig by value.
• refactor!: Pass OIDCSubjectClaimCustomTemplate by value in the OIDC subject-claim Set methods (#​4340)
  BREAKING CHANGE: SetOrgOIDCSubjectClaimCustomTemplate and SetRepoOIDCSubjectClaimCustomTemplate now take their body params by value.
• feat!: Refactor actions variables to pass request by value (#​4346)
  BREAKING CHANGE: ActionsService methods involving variables have new params and return values.
• feat!: Replace actions env secret endpoints (#​4335)
  BREAKING CHANGE: ActionsService methods involving secrets have new params and return values.
• refactor!: Pass CreateJITConfigRequest by value and rename Generate*JITConfig to Create*JITConfig (#​4337)
  BREAKING CHANGE: the JIT config methods are renamed from Generate*JITConfig to Create*JITConfig, and they now take CreateJITConfigRequest (renamed from GenerateJITConfigRequest) by value instead of by pointer.
• refactor!: Pass release-notes and asset params by value and rename EditReleaseAsset to UpdateReleaseAsset (#​4336)
  BREAKING CHANGE: GenerateReleaseNotes now takes GenerateNotesRequest by value (renamed from GenerateNotesOptions); EditReleaseAsset is renamed to UpdateReleaseAsset and takes UpdateReleaseAssetRequest by value.
• refactor!: Pass release params by value and rename EditRelease to UpdateRelease (#​4329)
  BREAKING CHANGE: CreateRelease & UpdateRelease now take RepositoryRelease by value; EditRelease is renamed to UpdateRelease.
• refactor!: Pass GistsService required params by value (#​4320)
  BREAKING CHANGE: GistsService methods now pass required params by-value instead of by-ref.
• fix!: Send request body in SCIM update methods (#​4315)
  BREAKING CHANGE: UpdateProvisionedOrgMembership and UpdateAttributeForSCIMUser params and return values changed.
• fix!: Fix LicenseStatus response and Supportkey type (#​4297)
  BREAKING CHANGE: LicenseStatus.SupportKey type changed from *string to *bool and License return type is no longer a slice.
• fix!: Enterprise App installation repos options structs (#​4298)
  BREAKING CHANGE: SelectedRepositoryIDs []int64 is now Repositories []string in *AppInstallationRepositoriesOptions.

...and the following additional changes:

• chore: Bump version of go-github to v89.0.0 (#​4369)
• feat: Add user team membership fields (#​4347)
• chore: Add deprecated flag for unused metadata (#​4367)
• docs: Add AGENTS.md and review-feedback tip (#​4368)
• chore: Mark removed billing endpoints as deprecated (#​4362)
• chore: Validate metadata (#​4358)
• chore: Bump golang.org/x/tools to v0.47.0 (#​4357)
• build(deps): Bump actions/setup-go from 6.4.0 to 6.5.0 in the actions group (#​4349)
• build(deps): Bump the go_modules group in /example (#​4345)
• feat: Add AccessSource to Team (#​4344)
• docs: Update CONTRIBUTING.md (#​4341)
• build(deps): Bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 (#​4342)
• docs: Extend CONTRIBUTING.md with code guidelines (#​4339)
• fix: AuditEntry fields org and org_id can be an array (#​4333)
• build(deps): Bump actions/checkout from 6.0.3 to 7.0.0 in the actions group (#​4332)
• feat: Add code quality findings support (#​4330)
• chore: Update openapi_operations.yaml (#​4331)
• chore: Replace time.Date with referenceTime (#​4325)
• test: Refactor tests for ProjectV2Item.UnmarshalJSON (#​4323)
• chore: Remove obsolete test/fields utility (#​4322)
• feat: Add Issue Dependencies API support (#​4130)
• fix: Set GetBody on uploads for HTTP/2 retry (#​4318)
• chore: Remove deleted account from REVIEWERS (#​4317)
• build(deps): Bump golang.org/x/crypto from 0.52.0 to 0.53.0 in /example (#​4305)
• build(deps): Bump codecov/codecov-action from 6.0.1 to 7.0.0 (#​4303)
• build(deps): Bump golang.org/x/net from 0.55.0 to 0.56.0 in /scrape (#​4302)
• build(deps): Bump golang.org/x/term from 0.43.0 to 0.44.0 in /example (#​4304)
• build(deps): Bump golang.org/x/tools from 0.45.0 to 0.46.0 in /tools (#​4314)
• build(deps): Bump github.com/bradleyfalzon/ghinstallation/v2 from 2.18.0 to 2.19.0 in /example (#​4306)
• refactor: Fix parameters in method endpoints (#​4300)
• feat: Add enterprise billing usage endpoints and response types (#​4288)
• build(deps): Bump golang.org/x/sync from 0.20.0 to 0.21.0 in /tools (#​4294)
• build(deps): Bump github.com/getkin/kin-openapi from 0.139.0 to 0.140.0 in /tools (#​4295)
• build(deps): Bump actions/checkout from 6.0.2 to 6.0.3 in the actions group (#​4293)
• fix: Reject URL path segments containing percent-encoded dots (#​4291)
• fix: Comparison of durations in AbuseRateLimitError.Is (#​4292)
• test: Replace &x variables with inline Ptr(value) calls (#​4289)
• feat: Inject OpenAPI deprecations safely (#​4286)
• chore: Remove 'munlicode' from REVIEWERS (#​4287)
• feat: Add GetOrgAICreditUsage and GetUserAICreditUsage endpoints (#​4282)
• test: Fix test names and error messages (#​4284)
• test: Use testJSONBody helper for request body assertions (#​4283)
• feat: Add pull request fields to Repository (#​4268)
• build(deps): Bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 (#​4272)
• build(deps): Bump go.opentelemetry.io/otel to v1.44.0 (#​4280)
• build(deps): Bump golang.org/x/net from 0.54.0 to 0.55.0 in /scrape (#​4271)
• build(deps): Bump golang.org/x/crypto from 0.51.0 to 0.52.0 in /example (#​4273)
• fix: Handle missing reviewer type in RequiredReviewer unmarshal (#​4270)
• test: Remove redundant Marshal tests (#​4266)
• chore: Update openapi_operations.yaml (#​4265)
• feat: Add support for GitHub Code Quality API (#​4260)
• build(deps): Bump github.com/getkin/kin-openapi from 0.138.0 to 0.139.0 in /tools (#​4261)
• chore: Fix zizmor security issues in GHA workflows (#​4259)
• feat: Add support for getting Copilot cloud agent configuration (#​4241)
• feat: Add client API version support (#​4246)
• test: Add secret scanning marshal tests (#​4252)
• lint: Improve extraneousnew linter to catch unnecessary use of value var (#​4249)
• build(deps): Bump codecov/codecov-action from 6.0.0 to 6.0.1 (#​4248)
• chore: Bump go-github from v87 to v88 in /scrape (#​4247)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​google/​go-github/​v90@​v90.0.0

View full report

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.32%. Comparing base (1ba15d4) to head (78c5e36).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2198      +/-   ##
==========================================
+ Coverage   87.86%   88.32%   +0.46%     
==========================================
  Files         395      395              
  Lines       35481    35481              
==========================================
+ Hits        31174    31338     +164     
+ Misses       4303     4139     -164     
  Partials        4        4              

Flag	Coverage Δ
integration	12.95% <ø> (+4.74%)	⬆️
unit	85.84% <ø> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[ALRubinger]

🐑 renovate-shepherd triage: needs a human decision

Major bump (v88.0.0 → v90.0.0, skipping v89), so it is outside unattended-merge policy by default. But there is a more specific problem: as authored, this PR does not actually perform the upgrade.

The diff is a no-op that leaves an unused dependency behind

 	github.com/google/go-github/v88 v88.0.0
+	github.com/google/go-github/v90 v90.0.0

Go major versions are distinct module paths, so Renovate added /v90 to require without removing /v88 and without touching a single import. Confirming it is unused: go.sum gained only the /go.mod hash for v90, not the h1: module hash a real build would need.

The one file that actually imports the library still points at v88:

• internal/source/github/connector.go — the only import site in the repo

So merging this as-is would add a dependency nothing imports, keep the code on v88, and a later go mod tidy would drop the new line again.

What the real migration looks like

1. Repoint the import in internal/source/github/connector.go from go-github/v88 to go-github/v90.
2. Drop the github.com/google/go-github/v88 require and go mod tidy in internal/.
3. Review the v89 and v90 release notes — two majors are being crossed at once, and go-github's majors routinely reshape API structs.

Blast radius on our side is small (one import site), but "small" is not "zero", and crossing two majors of a GitHub API client is a judgment call about behavior, not a mechanical repair. Escalating rather than guessing.

CI status is not evidence of compatibility here

Integration Tests (E2E) failed at 30m18s with The operation was canceled. — that is the apt-mirror stall against azure.archive.ubuntu.com that hit several PRs in the same window (#2153, #2184), not a real break.

Everything else is green — but do not read that as "v90 is source-compatible." Nothing in the build ever loaded v90, because no import references it.

— renovate-shepherd