feat(deps): upgrade go-github to v89 (#2395)

## What

- Upgrade the direct `go-github` dependency from `v72` to `v89` (latest major) in the in-repo `github://` source driver (`internal/migrate/source/github`), and update the package doc reference. Vendor is regenerated through the repo dep flow (vendor is gitignored; CI re-vendors via `make dep`).
- Adapt to v89's redesigned client construction: `NewClient` now takes functional options and returns an error, and `WithAuthToken` is a package-level option rather than a `*Client` method. The driver builds an options slice and returns the constructor error. The `github://[user:token@]owner/repo[/path][#ref]` URL contract and runtime behavior are unchanged.
- Non-goal: this does not drop `golang.org/x/oauth2` (the driver never used it) and makes no functional or URL changes — it is a version bump plus the minimal API adaptation.

## Why

- Keep the direct `go-github` dependency current. `v72` was a conservative pick when the in-repo driver replaced the upstream golang-migrate GitHub driver; nothing forced it over the latest major. Moving to `v89` now reduces future major-version churn and aligns the service with the version we intend to propose upstream to `golang-migrate/migrate` (golang-migrate/migrate#1410).
- Security-neutral by design: both `v72` and `v89` are free of `golang.org/x/crypto/openpgp`, so this does not change the GO-2026-5932 outcome — it is maintenance, not the fix. The openpgp finding stays cleared (verified below).

## Testing

- `make lint` - passed (Go: 0 issues; Ruby: 27 files, no offenses)
- `make sec` - passed (exit 0). govulncheck: code affected by 0 vulnerabilities; GO-2026-5932 remains only an uncalled module-level note on `golang.org/x/crypto`, and `go mod why golang.org/x/crypto/openpgp` reports the package is not needed. Trivy: 0 vulnerabilities for `go.mod` and `test/Gemfile.lock`.
- `go build -mod vendor ./...` - passed; `go vet` - passed; `go mod verify` - all modules verified.
- Validation gap: the authenticated `github://` path (`WithAuthToken`) is not exercised locally or by CI. The feature fixture is a public repository, so only the unauthenticated path runs end-to-end. The auth change is a mechanical swap to go-github's documented v89 option, but it has no runtime proof in this repo.
- `make features` - not run locally (needs Postgres); CI exercises the `github://` scenarios end-to-end for the unauthenticated path.

AI-assisted-by: [Claude Code](https://claude.com/claude-code)

Author: alexfalkowski

go.mod

@@ -6,7 +6,7 @@ require (
 	github.com/alexfalkowski/go-health/v2 v2.33.0
 	github.com/alexfalkowski/go-service/v2 v2.652.0
 	github.com/golang-migrate/migrate/v4 v4.19.1
-	github.com/google/go-github/v72 v72.0.0
+	github.com/google/go-github/v89 v89.0.0
 	github.com/jackc/pgx/v5 v5.10.0
 	go.opentelemetry.io/otel/metric v1.44.0
 	google.golang.org/grpc v1.82.0
@@ -48,7 +48,7 @@ require (
 	github.com/go-playground/validator/v10 v10.30.3 // indirect
 	github.com/go-sprout/sprout v1.0.3 // indirect
 	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
-	github.com/google/go-querystring v1.1.0 // indirect
+	github.com/google/go-querystring v1.2.0 // indirect
 	github.com/google/pprof v0.0.0-20260604005048-7023385849c0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/gorilla/websocket v1.5.3 // indirect

go.sum

@@ -122,13 +122,13 @@ github.com/golang/mock v1.7.0-rc.1 h1:YojYx61/OLFsiv6Rw1Z96LpldJIy31o+UHmwAUMJ6/
 github.com/golang/mock v1.7.0-rc.1/go.mod h1:s42URUywIqd+OcERslBJvOjepvNymP31m3q8d/GkuRs=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
-github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/go-github/v72 v72.0.0 h1:FcIO37BLoVPBO9igQQ6tStsv2asG4IPcYFi655PPvBM=
-github.com/google/go-github/v72 v72.0.0/go.mod h1:WWtw8GMRiL62mvIquf1kO3onRHeWWKmK01qdCY8c5fg=
-github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
-github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
+github.com/google/go-github/v89 v89.0.0 h1:35bEK5XoEcF3PZrlVbl9XN63f5BcJRA/UGkxeC9xPg0=
+github.com/google/go-github/v89 v89.0.0/go.mod h1:QLcbU0ipeAqQuR5KSg8c2lql4Qk1EwJ2dWz/0rP4Nho=
+github.com/google/go-querystring v1.2.0 h1:yhqkPbu2/OH+V9BfpCVPZkNmUXhb2gBxJArfhIxNtP0=
+github.com/google/go-querystring v1.2.0/go.mod h1:8IFJqpSRITyJ8QhQ13bmbeMBDfmeEJZD5A0egEOmkqU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/pprof v0.0.0-20240227163752-401108e1b7e7/go.mod h1:czg5+yv1E0ZGTi6S6vVK1mke0fV+FaUhNGcd6VRS9Ik=
 github.com/google/pprof v0.0.0-20260604005048-7023385849c0 h1:h1QTMDl6q9wDvDCJVpKQSjgleGFYnd2fOxmg2K+6BGE=
@@ -388,7 +388,6 @@ golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
 golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
 google.golang.org/genproto/googleapis/api v0.0.0-20260706201446-f0a921348800 h1:admdQBe8jR3VWhBsUrAOaF2Qw6K/+p5pSm1GN8+6Fw4=

internal/migrate/source/github/doc.go

@@ -2,7 +2,7 @@
 // files from a GitHub repository.
 //
 // It exists so Migrieren depends on a maintained go-github release
-// (github.com/google/go-github/v72) instead of the upstream golang-migrate
+// (github.com/google/go-github/v89) instead of the upstream golang-migrate
 // GitHub source driver, which pins github.com/google/go-github/v39 and
 // transitively imports the unmaintained golang.org/x/crypto/openpgp package
 // (advisory GO-2026-5932).

internal/migrate/source/github/github.go

@@ -11,7 +11,7 @@ import (
 	"github.com/alexfalkowski/go-service/v2/io"
 	"github.com/alexfalkowski/go-service/v2/strings"
 	"github.com/golang-migrate/migrate/v4/source"
-	"github.com/google/go-github/v72/github"
+	"github.com/google/go-github/v89/github"
 )
 
 var (
@@ -75,14 +75,19 @@ func (d *Driver) Open(rawURL string) (source.Driver, error) {
 		return nil, err
 	}
 
-	client := github.NewClient(nil)
+	var opts []github.ClientOptionsFunc
 	if parsed.User != nil {
 		token, ok := parsed.User.Password()
 		if !ok {
 			return nil, ErrNoPassword
 		}
 
-		client = client.WithAuthToken(token)
+		opts = append(opts, github.WithAuthToken(token))
+	}
+
+	client, err := github.NewClient(opts...)
+	if err != nil {
+		return nil, err
 	}
 
 	repository, repoPath, _ := strings.Cut(strings.Trim(parsed.Path, "/"), "/")