chore(deps-core): update octokit packages to types v17 and rest-endpoint-methods v18

[afonsojramos]

Summary

Lands the two open Renovate octokit bumps together, because neither can pass CI on its own:

• chore(deps-core): update @octokit/types to v17 - autoclosed #3155 — @octokit/types 16 → 17
• chore(deps-core): update @octokit/plugin-rest-endpoint-methods to v18 - autoclosed #3154 — @octokit/plugin-rest-endpoint-methods 17 → 18

Both PRs fail tsc --noEmit with variations of Type '{ id: number | bigint; ... }' is not assignable to type '{ id: number; ... }'.

Root cause

@octokit/openapi-types v28 widened every entity id from number to number | bigint, and the repo depends on the octokit packages as separate pinned versions:

consumer	resolves openapi-types via	id
components[...] in forges/github/types.ts	direct dep, already 28.0.0	number | bigint
Endpoints[...] in forges/github/types.ts	@octokit/types@16 → ^27.0.0	number
octokit.rest.* return types	plugin-rest-endpoint-methods@17 → @octokit/types@16 → ^27.0.0	number

main carries two copies of @octokit/openapi-types (27.0.0 and 28.0.0) and only typechecks today because the mismatch is bridged by as casts, which stay legal while {id: number} is assignable to {id: number | bigint}.

Bumping one package moves a subset of those rows to bigint and breaks the bridge in whichever direction was bumped, which is why each PR fails in a different file:

• chore(deps-core): update @octokit/types to v17 - autoclosed #3155 moves Endpoints to bigint while octokit.rest.* stays on number → fails in useAccountsStore.test.ts
• chore(deps-core): update @octokit/plugin-rest-endpoint-methods to v18 - autoclosed #3154 moves octokit.rest.* to bigint while Endpoints stays on number → fails in client.ts

Bumping both collapses the lockfile to a single @octokit/openapi-types@28.0.0, so every row above agrees on number | bigint. No application code changes are required.

Preventing recurrence

:separateMultipleMajorReleases puts one target major per branch, which is what split the shared octokit monorepo group into renovate/major-17-… and renovate/major-18-… in the first place. Added a package rule pinning @octokit/** to a single group with separateMultipleMajor: false so future octokit majors arrive as one PR. Verified with renovate-config-validator.

Verification

• tsc --noEmit — clean
• pnpm test — 165 files, 1295 tests passed
• vp check — 420 files formatted, 0 lint errors
• pnpm install --frozen-lockfile — passes, including the supply-chain / minimumReleaseAge gate

Supersedes #3155 and #3154; both should close automatically once this merges.

Note

GitHub Actions is in a major outage (started 2026-08-06 15:22 UTC) and webhook-triggered workflows are only being gradually restored, so no pull_request CI has run on this repo since ~17:53 UTC — every currently open PR shows only the CodeQL checks. The checks above will need a re-run once Actions recovers. All four gates were verified locally in the meantime (see Verification).

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud