ci: diagnose GitHub provenance authentication

Author: ngallodev

Jenkinsfile

@@ -47,6 +47,8 @@ pipeline {
                     sh '''
                         set -eu
                         export PATH="$WORKSPACE/.ci-venv/bin:$PATH"
+                        gh api user --jq .login >/dev/null
+                        gh api rate_limit --jq '.resources.core | "GitHub API rate limit: \(.remaining)/\(.limit) remaining"'
                         scripts/license-gate.sh --selftest
                         scripts/license-gate.sh
                         scripts/audit-license-provenance.py

scripts/audit-license-provenance.py

@@ -75,6 +75,8 @@ def gh_api(path):
     """Fetch one GitHub API path once per audit process."""
     r = subprocess.run(["gh", "api", path], capture_output=True, text=True)
     if r.returncode != 0:
+        detail = r.stderr.strip().replace("\n", " ")
+        print(f"GitHub API request failed ({path}): {detail}", file=sys.stderr)
         return None
     return r.stdout