fix(github-client): fetchLatestSemverTag throws instead of returning undefined when auth unavailable

getOctokit() was called outside the try/catch, so an AUTH_MISSING
throw propagated as a test failure rather than the function silently
returning undefined — the contract documented by the test's own guard.
Moved getOctokit() inside the try block.

Also explicitly passes GITHUB_TOKEN to the CI test step so integration
tests have the Actions token available regardless of runner defaults.

Author: AlbinoGeek

.github/workflows/ci.yml

@@ -29,6 +29,8 @@ jobs:
         run: bun run check
 
       - name: Unit tests with coverage
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           bun run test:coverage 2>&1 | tee /tmp/coverage.txt
           node -e "

src/server/github-client.ts

@@ -228,8 +228,8 @@ export async function fetchLatestSemverTag(
   owner: string,
   repo: string,
 ): Promise<string | undefined> {
-  const octokit = getOctokit();
   try {
+    const octokit = getOctokit();
     const res = await octokit.repos.listTags({ owner, repo, per_page: 20 });
     const semverRe = /^v?\d+\.\d+\.\d+$/;
     return res.data.filter((t) => semverRe.test(t.name))[0]?.name;