fix: resolve "latest" CLI version using the action's own token, not an env var (#852)

* fix: resolve "latest" CLI version using the action's own token, not an env var

`resolveLatestTag()` only checked `process.env.GITHUB_TOKEN`/`GH_TOKEN` for
authenticating the GitHub API call that resolves `cliVersion: latest`. GitHub
Actions does not inject GITHUB_TOKEN into a JS action's process environment
automatically - a calling workflow has to set it explicitly via `env:` - and
essentially no consumer workflow had reason to do that before this action
started making its own API calls. So this was unauthenticated for effectively
every consumer, not just ones under unusual load, and the unauthenticated
limit (60 req/hour, shared across every job on the runner's IP) is easy to
exhaust.

Hit live via game-ci/unity-test-runner#328's consumer, whose six-version test
matrix failed simultaneously with "GitHub API returned 403" - this action
shares the identical resolveLatestTag/downloadCli pattern (copy-pasted, per
the original comments referencing each other) and is exposed to the exact same
gap.

This action had no `githubToken` input at all, unlike unity-test-runner, so
there was no way for a consumer to hand it a token even deliberately. Added
one, defaulting to `${{ github.token }}` - populated by GitHub Actions on
every run with no consumer action needed - and threaded it through
downloadCli -> resolveLatestTag, ahead of the env var fallback (kept for the
CLI/install.sh path, which has no Action input to read from).

2 new tests, confirmed to catch the regression: removing the parameter
threading fails exactly "sends an Authorization header from the githubToken
parameter" and "forwards its githubToken parameter to resolveLatestTag", and
nothing else in the existing 12.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

* fix: satisfy yarn format:check on download-cli.ts

Co-Authored-By: Claude Sonnet 5 <[email protected]>

* test: cover the GH_TOKEN fallback branch in resolveLatestTag

Co-Authored-By: Claude Sonnet 5 <[email protected]>

* test: verify explicit githubToken takes precedence over env fallbacks

Addresses a CodeRabbit nitpick on PR #852: the existing tests covered
the GITHUB_TOKEN and GH_TOKEN fallback paths individually but not the
precedence rule itself (githubToken > GITHUB_TOKEN > GH_TOKEN) when
more than one is present at once.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

---------

Co-authored-by: Claude Sonnet 5 <[email protected]>

action.yml

@@ -19,6 +19,13 @@ inputs:
     description:
       'Release tag of the game-ci/cli binary to install and run (e.g. "v0.1.0"). Defaults to the latest release; pin
       this for reproducible builds.'
+  githubToken:
+    required: false
+    default: '${{ github.token }}'
+    description:
+      'Token used to authenticate the GitHub API call that resolves cliVersion: latest to a concrete release tag.
+      Defaults to the token GitHub Actions provides for every run automatically - no need to set this unless you
+      have a reason to override it.'
   customImage:
     required: false
     default: ''