Keep alert publisher dependencies on compatible SDK majors #5323

🤖 Generated by the Agentic Engineer

Description

The alert publisher uses ghinstallation v2.19.0, whose public token and scope types require go-github v88. A v93 requirement merged in #5314 without migrating those callers, and the subsequent update #5321 failed tests and vulnerability scanning before either could run.

Steps to Reproduce

1. Inspect fix(deps): update module github.com/google/go-github/v88 to v93 #5321 at 0373a3a.
2. Run the root-module tests with module updates disabled.
3. Observe the module-tidy refusal reported by hosted runs 40174342806 and 40174342810. Changing imports alone also produces incompatible auth types.

Expected Behavior

The publisher and its authentication library use compatible SDK types, the module graph is tidy, and normal tests and vulnerability scanning complete.

Resolution

#5325 is the canonical prepared repair: remove the unused v93 requirement and require deliberate approval of a future major migration together with a compatible authentication-library release. #5321 was deliberately closed; it must not be reopened as a check-refresh mechanism.

A separate local v93 adaptation passed the publisher race tests and complete root Go suite, but retained both SDK majors at the authentication boundary. It was not published because the smaller compatibility repair delivers the needed outcome. No duplicate source PR is required.

Acceptance Criteria

• The root module is tidy and the publisher remains on SDK types compatible with the released authentication library.
• Compatible updates remain enabled; any future major migration is deliberate and keeps publisher permission, receipt and duplicate-delivery protections intact.
• fix(deps): keep go-github on the major ghinstallation uses #5325 passes current-head CI and ordinary review, merges through protection, and receives post-merge verification.

Delivery verified on 2026-10-25: #5325 protected-merged source 7b7cad688195157f8aa80a0e3df0d6e3efb076c6 as signed commit f4728c177af60114de99be5ba29b14bc09be7295 at 10:22:42 UTC. All three changed files match the reviewed source bytes. The complete post-merge inventory contains 62 unique checks: 45 successful and 17 intentional skips, including normal tests and vulnerability scanning. Default-branch CI 40184525190 and the remaining post-merge workflows passed; the production health check also passed. The compatibility repair and deliberate major-update approval rule satisfy this issue. No credential change or live alert write was performed.