fix(reliability): authenticate public GitHub profile fetches (#790)

[JSONbored]

Completes #790 — the timeout half shipped in #817. fetchPublicContributorProfile's two api.github.com calls were unauthenticated (60/hr ceiling), so the 500-login contributor-evidence loop could exhaust it and silently return source: unavailable.

Thread an optional env through the 8 callers and send Authorization: Bearer when GITHUB_PUBLIC_TOKEN is set, lifting the ceiling to 5000/hr (mirrors the existing fetchPublicRepoStats). Signature stays backward-compatible (env optional). Surgical: 6 source files, single-token call-site edits, no reformatting.

Test: asserts both fetches carry Bearer <token> when the token is set, and no auth header when absent. 129 caller-area tests pass; typecheck clean.

Closes #790

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#819 is no longer open.	No action.

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[ghost]

gittensory · advisory review

Reviewed 7 changed file(s) — two independent AI reviewers.

Changed files: src/api/routes.ts, src/github/public.ts, src/mcp/server.ts, src/queue/processors.ts, src/services/agent-orchestrator.ts, src/services/decision-pack.ts, test/unit/adapters.test.ts

Suggested action: ✅ Safe to merge — both reviewers found no blocking issues.

Reviewer A · gpt-oss-120b — recommends ✅ merge
The PR adds optional authentication to public GitHub profile fetches to lift rate limits, updates all call sites to pass the environment when available, and adds tests to verify header behavior. The changes are scoped, type‑safe, and do not alter public output.

Suggestions

• Add a brief comment to the function header documenting the purpose of the optional env and the security considerations of the token.
• Consider adding a lint rule or test to ensure the GITHUB_PUBLIC_TOKEN is never logged or returned in any response.
• Update any relevant documentation (e.g., README or API docs) to note the new optional auth capability.

Worth double-checking

• Make sure no other modules call fetchPublicContributorProfile with an env that lacks the token, which could inadvertently send undefined Authorization headers.
• Verify that the token is only available in trusted environments and not exposed in client‑side bundles.

Reviewer B · mistral-small-3.1-24b-instruct — recommends ✅ merge
This PR adds authentication to public GitHub profile fetches to lift the rate limit ceiling, improving reliability. The changes are consistent and well-documented.

Suggestions

• Consider adding a test case to handle scenarios where the GITHUB_PUBLIC_TOKEN is invalid or expired.
• Ensure that the GITHUB_PUBLIC_TOKEN is securely managed and not exposed in logs or error messages.

Worth double-checking

• Verify that the authentication mechanism does not introduce any security vulnerabilities.
• Check that the rate limit lifting does not inadvertently expose sensitive information.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.77%. Comparing base (7d7d26d) to head (3285ef9).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #819   +/-   ##
=======================================
  Coverage   96.77%   96.77%           
=======================================
  Files          97       97           
  Lines       14000    14001    +1     
  Branches     5098     5099    +1     
=======================================
+ Hits        13548    13549    +1     
  Misses         86       86           
  Partials      366      366           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.