chore(deps): Drop octokit from scanner in favor of plain fetch

[dividedmind]

packages/scanner used the full octokit metapackage for exactly one REST call: createCommitStatus() in integration/github/commitStatus.ts. That pulled octokit 2.0.19, whose transitive @octokit/webhooks 10.9.1 carries GHSA-pwfr-8pq7-x9qv (high, unauthenticated DoS).

The obvious fix -- bump to octokit 4 -- is not available to us. octokit 4 and 5 are "type": "module" with no require condition in their exports map, so they would break scanner's CommonJS build and the @yao-pkg/pkg native snapshot. octokit 3.x is still dual, but it is a dead end to park on.

Instead, drop the dependency. The call is now a plain fetch POST to /repos/{owner}/{repo}/statuses/{sha}. Global fetch was already in use in this package (src/rules/lib/openapiProvider.ts). Behaviour is unchanged apart from the failure path, which now throws a plain Error carrying status, statusText and body rather than octokit's RequestError; no caller inspects the error type. This removes 25 packages from the tree.

Also re-resolve @octokit/rest in packages/cli from 20.0.1 to 20.1.2. This is within the existing ^20.0.1 range, so no manifest change. 20.1.2 still publishes CJS -- it depends on the -cjs tagged plugin builds -- and pulls @octokit/core 5.2.2, which satisfies the patched floors for @octokit/request (>=8.4.1) and @octokit/request-error (>=5.1.1).

Net: 5 octokit advisories down to 3, and the high is cleared. The remainder are moderate ReDoS advisories reaching the tree only through @semantic-release/github 8.1.0, which is the newest 8.x, so there is no in-range fix for them.

Add test/integration/github/commitStatus.spec.ts covering the request shape, URL encoding, the non-2xx path, and validate-before-request. Note that nock 13 cannot intercept undici, so these stub globalThis fetch directly rather than using nock.

Assisted-by: Claude:claude-opus-5[1m]

[Copilot]

🟡 Changes recommended

The scanner now relies on global fetch despite supporting Node versions where fetch may not exist at runtime (per engines.node), risking a runtime crash for Node < 18 users.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR removes the octokit metapackage from packages/scanner by replacing the single createCommitStatus() usage with a direct HTTP POST, primarily to eliminate a high-severity transitive advisory while preserving the existing commit-status behavior.

Changes:

• Replaced Octokit-based commit status updates with a direct request to POST /repos/{owner}/{repo}/statuses/{sha}.
• Removed the octokit dependency from @appland/scanner and updated the lockfile accordingly.
• Added an integration test that validates request URL/encoding, request body/headers, config validation, and non-2xx behavior.

File summaries

File	Description
yarn.lock	Removes octokit (scanner) and re-resolves @octokit/rest transitive set per updated dependency graph.
packages/scanner/package.json	Drops the octokit dependency from scanner.
packages/scanner/src/integration/github/commitStatus.ts	Implements commit status updates via direct HTTP request instead of Octokit.
packages/scanner/test/integration/github/commitStatus.spec.ts	Adds test coverage for the new request-based implementation and failure/validation paths.

Review details

• Files reviewed: 3/4 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.