fix(scan github): propagate blocking errors during manifest download

A token-wide GitHub block (rate limit / auth / abuse detection) hit while
downloading a manifest file was swallowed when an earlier file had already
downloaded, so the scan proceeded on a partial manifest set and reported
success. Surface the blocking error immediately, mirroring the repo loop.

Also suppress the green per-run success lines on the all-repos-failed path
so scripts reading log lines cannot infer success from a run that returns
ok:false, and drop internal tracker IDs from comments and a test title.

Author: jdalton

src/commands/scan/create-scan-from-github.mts

@@ -113,12 +113,12 @@ export async function createScanFromGithub({
  * Drive the per-repo scan loop and decide the overall run result.
  *
  * The loop stops early on a blocking GitHub error (rate limit / auth / abuse
- * detection) because every remaining repo would fail the same way — that is
- * the ASK-167 bug: a rate-limited token made every repo fail its API calls,
- * the loop swallowed each failure, and the final "N repos / 0 manifests"
- * summary misled users and CI into thinking the scan succeeded when nothing
- * was uploaded. A run where every attempted repo failed for a non-blocking
- * reason is also surfaced as an error rather than a silent ok:true.
+ * detection) because every remaining repo would fail the same way. Previously
+ * a rate-limited token made every repo fail its API calls, the loop swallowed
+ * each failure, and the final "N repos / 0 manifests" summary misled users and
+ * CI into thinking the scan succeeded when nothing was uploaded. A run where
+ * every attempted repo failed for a non-blocking reason is also surfaced as an
+ * error rather than a silent ok:true.
  *
  * `scanRepoFn` is injected so this decision logic can be tested without the
  * GitHub network path.
@@ -161,12 +161,11 @@ export async function runGithubScanLoop(
     return blockingError
   }
 
-  logger.success(reposScanned, 'GitHub repos processed')
-  logger.success(scansCreated, 'with supported Manifest files')
-
   // If every attempted repo failed (but not for a known blocking reason),
   // treat the run as an error so scripts do not infer success from an
-  // ok:true with zero scans created.
+  // ok:true with zero scans created. Checked before the success lines below
+  // so an all-failed run never prints green "processed" output that a script
+  // reading log lines could mistake for success.
   if (
     reposScanned > 0 &&
     scansCreated === 0 &&
@@ -182,6 +181,9 @@ export async function runGithubScanLoop(
     }
   }
 
+  logger.success(reposScanned, 'GitHub repos processed')
+  logger.success(scansCreated, 'with supported Manifest files')
+
   return {
     ok: true,
     data: undefined,
@@ -389,8 +391,20 @@ async function testAndDownloadManifestFiles({
       if (result.data.isManifest) {
         fileCount += 1
       }
-    } else if (!firstFailureResult) {
-      firstFailureResult = result
+    } else {
+      // A blocking error (rate limit / auth / abuse detection) is token-wide:
+      // every remaining download would fail the same way, and an earlier
+      // successful download must not mask it into an ok:true scan of a
+      // partial manifest set. Surface it immediately, the same way the repo
+      // loop short-circuits on blocking errors.
+      if (isGitHubBlockingError(result.message)) {
+        logger.groupEnd()
+        logger.fail(result.message)
+        return result
+      }
+      if (!firstFailureResult) {
+        firstFailureResult = result
+      }
     }
   }
   logger.groupEnd()

src/commands/scan/create-scan-from-github.test.mts

@@ -45,7 +45,7 @@ const authFailed: ScanResult = {
   cause: 'GitHub authentication failed.',
 }
 
-describe('runGithubScanLoop (ASK-167)', () => {
+describe('runGithubScanLoop GitHub blocking-error handling', () => {
   it('stops and returns ok:false on a GitHub rate limit', async () => {
     const scanner = fakeScanner({
       'repo-a': rateLimited,

src/utils/github-errors.mts

@@ -6,8 +6,7 @@
  * to read every response body and JSON-parse it without ever inspecting the
  * HTTP status, so a rate-limit response (`403` with `x-ratelimit-remaining: 0`,
  * `429`, or a secondary-limit body) was misread as "repo has no default
- * branch / no manifests" and the run reported a silent success. See Linear
- * ASK-167.
+ * branch / no manifests" and the run reported a silent success.
  *
  * This module centralizes:
  * - Classifying a GitHub response as a blocking error (rate limit / abuse