chore(deps): update module github.com/bradleyfalzon/ghinstallation/v2 to v2.19.0

[red-hat-konflux]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/bradleyfalzon/ghinstallation/v2	v2.17.0 → v2.19.0

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

bradleyfalzon/ghinstallation (github.com/bradleyfalzon/ghinstallation/v2)

v2.19.0

Compare Source

What's Changed

• Update go-github to v85 by @​asvoboda in #​188
• Update go-github to v88 by @​asvoboda in #​192
• Bump the actions group across 1 directory with 2 updates by @​dependabot[bot] in #​190

Full Changelog: bradleyfalzon/ghinstallation@v2.18.0...v2.19.0

v2.18.0

Compare Source

What's Changed

• Bump actions/checkout from 4.2.2 to 5.0.0 by @​dependabot[bot] in #​165
• bump github.com/google/go-github to v83 and ci updates by @​cpanato in #​184
• Update google/go-github to v84 by @​asvoboda in #​185
• Bump actions/checkout from 5.0.0 to 6.0.2 by @​dependabot[bot] in #​180
• Bump golangci/golangci-lint-action from 8.0.0 to 9.2.0 by @​dependabot[bot] in #​176

Full Changelog: bradleyfalzon/ghinstallation@v2.17.0...v2.18.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:41 PM UTC · Completed 10:46 PM UTC
Commit: 01f864b · View workflow run →

[fullsend-ai-review]

Looks good to me

Previous run

Looks good to me

Previous run (2)

Looks good to me

Previous run (3)

Review — approve

PR: chore(deps): update module github.com/bradleyfalzon/ghinstallation/v2 to v2.19.0
Author: red-hat-konflux[bot] (MintMaker/Renovate)

Summary

Automated dependency update bumping github.com/bradleyfalzon/ghinstallation/v2 from v2.17.0 → v2.19.0. This transitively updates github.com/google/go-github from v75 → v88.

Analysis

Dimension	Assessment
Correctness	✅ No risk — both updated packages are // indirect dependencies. Neither ghinstallation nor go-github/v75 (now v88) is directly imported by any Go source file. The codebase uses go-github/v53 exclusively (in pkg/monitors/argocd/github/client.go), which is unaffected.
Security	✅ Updating dependencies to newer versions is generally a security improvement. The ghinstallation v2.18.0–v2.19.0 release notes show upstream dependency bumps (go-github v83→v88, CI tooling updates) with no security advisories.
Scope & intent	✅ Changes are limited to go.mod and go.sum — exactly what's expected for a dependency update. No source code changes.
Compatibility	✅ The ghinstallation/v2 bump follows semver (minor version). The go-github major version jump (v75→v88) is contained as a transitive dependency of ghinstallation and does not affect the project's direct v53 import.

Findings

No findings. This is a clean, low-risk automated dependency update.

Previous run (4)

Review — ✅ Approve

PR: #197 — chore(deps): update module github.com/bradleyfalzon/ghinstallation/v2 to v2.19.0
Author: red-hat-konflux[bot] (Renovate/MintMaker)
Risk: Low

Summary

This is an automated dependency update that bumps two indirect dependencies in go.mod and go.sum:

Package	Previous	Updated	Type
github.com/bradleyfalzon/ghinstallation/v2	v2.17.0	v2.19.0	indirect
github.com/google/go-github/v75 → v88	v75.0.0	v88.0.0	indirect (transitive)

Analysis

Correctness: No source code changes. Both updated packages are // indirect — they are transitive dependencies pulled in by other modules (likely ArgoCD). The project directly imports go-github/v53 (in pkg/monitors/argocd/github/client.go), not v75 or v88, so the major version jump in the transitive go-github has no source-level impact.

Security: The ghinstallation update (v2.17.0 → v2.19.0) bumps its internal go-github dependency from v75 to v88. The upstream changelogs show routine dependency updates and CI changes — no security advisories or vulnerability fixes cited, but staying current with authentication libraries is good practice.

Scope & intent: The PR is appropriately scoped — a single dependency bump with its transitive effects, generated by the configured Renovate bot. No extraneous changes.

Style/conventions: go.mod and go.sum changes follow standard Go module conventions. Checksums are updated correctly.

Documentation: No documentation changes needed for an indirect dependency update.

Verdict

No findings. The change is a routine indirect dependency update with no source code impact. Safe to merge.

Previous run (5)

Review — Approve ✅

Scope: Automated dependency update (go.mod, go.sum only — no source code changes)

Changes

Dependency	Old	New	Kind
github.com/bradleyfalzon/ghinstallation/v2	v2.17.0	v2.19.0	indirect
github.com/google/go-github	v75.0.0	v88.0.0	indirect (transitive via ghinstallation)

Analysis

• No source code changes. Only go.mod and go.sum are modified.
• Both packages are // indirect dependencies — neither ghinstallation nor go-github/v75 (now v88) is imported in any Go source file. The project directly uses go-github/v53 for its GitHub API interactions, which is unaffected by this update.
• Semver-compatible bump. The ghinstallation update is a minor version bump (v2.17 → v2.19), which is backward-compatible per semver. The go-github major version jump (v75 → v88) is a transitive dependency and does not affect this project's API surface.
• Author is the Renovate bot (red-hat-konflux[bot]), which is the expected automated dependency management tool for this repository.
• No security advisories are addressed in the release notes — the update primarily tracks upstream go-github version bumps and CI tooling updates in the ghinstallation library.
• go.sum hashes are consistent and properly updated for both direct and transitive dependency changes.

Verdict

Safe to merge. This is a routine, low-risk transitive dependency update with no impact on the project's source code or behavior.

Previous run (6)

Review — ✅ Approve

PR: chore(deps): update module github.com/bradleyfalzon/ghinstallation/v2 to v2.19.0
Author: red-hat-konflux[bot] (Renovate/MintMaker)

Summary

Low-risk automated dependency update of two indirect (transitive) dependencies. No Go source code changes.

Dependency	Old	New	Scope
ghinstallation/v2	v2.17.0	v2.19.0	indirect
go-github (transitive via ghinstallation)	v75.0.0	v88.0.0	indirect

Analysis

Correctness — No logic changes. Both updated packages are // indirect in go.mod — they are transitive dependencies pulled in by argo-cd/v2, not directly imported by any .go source file in this repository. The project's direct dependency go-github/v53 is unaffected. The go.sum hashes are properly updated with matching h1: checksums for both packages.

Security — Updating transitive dependencies to current versions is a positive security practice. The ghinstallation library handles GitHub App installation token management; minor version updates typically include bug fixes and security improvements. No new dependencies are introduced.

Intent & Coherence — The PR is appropriately scoped: only go.mod and go.sum are modified, matching the automated dependency update intent. The PR title and body accurately describe the change.

Style/Conventions — Machine-generated go.mod/go.sum changes follow standard Go module conventions. No issues.

Documentation — No documentation updates needed for indirect dependency bumps.

Cross-repo Contracts — No API surface changes. This repository's exported interfaces and behavior are unchanged.

Note

The go-github major version jump (v75 → v88) is large but carries no risk here since it is a transitive dependency that no source code in this repository imports directly. The version jump is a consequence of ghinstallation v2.19.0 updating its own go-github dependency through several major releases.

No findings.

Previous run (7)

Looks good to me

Previous run (8)

Looks good to me

Previous run (9)

Looks good to me

Previous run (10)

Looks good to me

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:40 PM UTC · Completed 9:46 PM UTC
Commit: 01f864b · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 5:24 PM UTC · Completed 5:30 PM UTC
Commit: 01f864b · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:31 AM UTC · Completed 1:37 AM UTC
Commit: 01f864b · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:19 AM UTC · Completed 9:23 AM UTC
Commit: 58b0710 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:43 AM UTC · Completed 9:47 AM UTC
Commit: 58b0710 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:55 PM UTC · Completed 3:58 PM UTC
Commit: 58b0710 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:07 AM UTC · Completed 10:10 AM UTC
Commit: 58b0710 · View workflow run →

[fullsend-ai-review]

🤖 Review · ❌ Terminated · Started 9:38 PM UTC · Ended 9:48 PM UTC
Commit: 58b0710 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 5:26 AM UTC · Completed 5:32 AM UTC
Commit: 58b0710 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:30 AM UTC · Completed 1:37 AM UTC
Commit: 58b0710 · View workflow run →