Error: Cannot find module 'tunnel' in `@actions/github@5.0.2`

[akphi]

Describe the bug
In the latest version of @actions/github 5.0.2, we got the following error in our pipeline

node:internal/modules/cjs/loader:933
  const err = new Error(message);
              ^

Error: Cannot find module 'tunnel'
Require stack:
- /home/runner/work/legend-studio/legend-studio/node_modules/@actions/http-client/lib/index.js
- /home/runner/work/legend-studio/legend-studio/node_modules/@actions/core/lib/oidc-utils.js
- /home/runner/work/legend-studio/legend-studio/node_modules/@actions/core/lib/core.js
    at Function.Module._resolveFilename (node:internal/modules/cjs/loader:933:15)
...

To Reproduce

This is our repo
https://github.com/finos/legend-studio/runs/6414726076?check_suite_focus=true

Expected behavior

I think this happens because we use Yarn to install dependencies and we got a problem with Yarn not installing tunnel because it is a devDependency of http-client, but in fact, tunnel should be a runtime dependency of http-client.

I believe the workaround from our end is not so complicated - just manually installing tunnel, but could we make this a dependency instead?

Thank you so much!

Screenshots
If applicable, add screenshots to help explain your problem.

Desktop (please complete the following information):

• OS: [e.g. iOS]
• Browser [e.g. chrome, safari]
• Version [e.g. 22]

Smartphone (please complete the following information):

• Device: [e.g. iPhone6]
• OS: [e.g. iOS8.1]
• Browser [e.g. stock browser, safari]
• Version [e.g. 22]

Additional context
Add any other context about the problem here.

[alice-was-here]

We've woken up to a similar issue this morning in our CI/CD pipeline. A quick fix if you're using @actions/core is to pin it to the previous version, e.g.: npm i @actions/core@1.8.0.

[arminrosu]

not installing tunnel because it is a devDependency of http-client, but in fact, tunnel should be a runtime dependency of http-client.

I believe the workaround from our end is not so complicated - just manually installing tunnel, but could we make this a dependency instead?

Looks like when actions/http-client was merged into actions/toolkit in #1062 the tunnel dependency was changed to a devDependency. That's when @actions/http-client@2.0.0 and @actions/core@1.8.1 were released. Likely an oversight.

[karlhorky]

Seems like @gfx opened #1084 to fix this, 👀 watching over there now