fix(github): default octokit to native fetch to prevent empty release lists

[jjeff]

Fixes #27.

Problem

PecansGitHubBackend hard-wires node-fetch@2 as octokit's request.fetch. In some runtimes (reproduced on DigitalOcean App Platform against a repo with ~390 releases), node-fetch@2 fails to parse the large, gzipped, multi-page listReleases response, so octokit.paginate() silently resolves to []. Pecans caches zero releases and every download/update returns nothing — with no error logged. (Error responses such as a 404 still parse, so a bad token surfaces loudly while a valid token silently returns an empty list.)

Native fetch (undici) parses the same response correctly. This package already requires Node >=22, so globalThis.fetch is always available.

Change

• Default octokit's request.fetch to globalThis.fetch.
• Add an optional fetch to PecansGitHubBackendOpts so callers/tests can override the implementation.
• Inject node-fetch in the integration-test backend helper so nock continues to intercept HTTP (nock v13 does not intercept undici). Production keeps the native default.

Asset-streaming downloads still use node-fetch (they rely on the Node-stream .body) and are intentionally left unchanged.

Verification

• Full suite green with the CI-equivalent fake credentials: 631 passed (24 files), fully hermetic via nock.
• tsc --noEmit clean.
• Reproduced the original failure and confirmed the fix out-of-band: with native fetch, releases() returns all 392 releases (99 non-draft, stable latest 5.0.15); with node-fetch@2 in the affected runtime it returned empty.

Follow-up (not in this PR)

The injected node-fetch@2 is likely the source of long-standing deprecation warnings; a separate change could drop node-fetch@2 entirely and/or bump @octokit/rest from ^20.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR fixes a production-impacting issue in the GitHub backend where forcing Octokit to use node-fetch@2 could cause octokit.paginate() to silently return an empty release list for large, multi-page listReleases responses. It updates the backend to default to the runtime’s native globalThis.fetch (available on Node >=22 per this repo’s engine constraint), while still allowing tests/callers to inject an alternate fetch implementation.

Changes:

• Default Octokit’s request.fetch to globalThis.fetch to avoid node-fetch@2 parsing failures on large release listings.
• Add an optional fetch override to PecansGitHubBackendOpts so callers/tests can supply a custom fetch implementation.
• Update integration tests to inject node-fetch so nock (v13) can continue intercepting Octokit HTTP calls.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
test/integration/integration.spec.ts	Injects node-fetch into the backend in tests so nock can intercept Octokit requests when production defaults to native fetch.
src/backends/github.ts	Adds opts.fetch and uses it (or globalThis.fetch) for Octokit requests to prevent silent empty release lists in some environments.

[dopry]

Just remove node-fetch so it uses the built in. the comments are unnecessary

[Copilot]

Pull request overview

Copilot reviewed 6 out of 8 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

package.json:24

• The PR description mentions keeping node-fetch for asset streaming and injecting it in tests because nock v13 can’t intercept native fetch, but this PR removes node-fetch entirely and upgrades nock to v14 (which changes that constraint). Please update the PR description/issue text to match the actual approach taken here (native fetch everywhere + nock v14), or reintroduce the described node-fetch injection if that’s still desired.

  "dependencies": {
    "@octokit/rest": "^20.0.1",
    "@octokit/webhooks": "^12.0.3",
    "body-parser": "^1.19.0",
    "express": "^4.18.1",
    "express-useragent": "^1.0.15",
    "semver": "^7.3.7",
    "ts-node": "^10.8.1",
    "urljoin.js": "^1.0.0",
    "uuid": "^8.3.2"