fix(sync-nlb-checker): fall through to HTTPS when gh is not on PATH

[d-morrison]

Closes #2338

_fetch in scripts/sync-nlb-checker.py ran gh api through subprocess.run and read the exit status to decide whether to try raw HTTPS, but a machine with no gh on PATH never gets an exit status: subprocess.run raises FileNotFoundError, which escaped _fetch instead of reaching the documented HTTPS route (the non-blocking finding deferred from #2322's review).

What changed

• The OSError is caught, its text kept as the gh-side reason, and the HTTPS route runs exactly as it does for any other gh failure; when both routes fail the SystemExit still names both.
• scripts/test_sync_nlb_checker.py, offline with both routes stubbed: missing gh falls through to HTTPS; a working gh never consults HTTPS; a failing gh falls through; and both both-fail cases name the gh reason and the HTTPS error. Registered in validate.yml (check-test-suites-covered.py: 55 of 55 gated).

Validation

The new suite, scripts/test_slb.py (104 cases), check-ascii-punctuation.py, and check-test-suites-covered.py pass at the pushed head. Against the pre-fix script, a stubbed missing gh raises FileNotFoundError out of _fetch (the defect reproduces).

No adversarial self-review subagent ran before this push (the auto-mode classifier denies dispatches from this session), so the bot review is the first independent read.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VJ5YLpnoipBafisrTZkCCt

---

Generated by Claude Code

[github-actions]

Claude finished review — View run

---

Summary

PR #2933 fixes issue #2338: _fetch() in scripts/sync-nlb-checker.py previously let a missing gh binary raise an uncaught FileNotFoundError (since subprocess.run raises OSError rather than returning a non-zero exit when the executable itself isn't found), which meant the documented "fall through to raw HTTPS" behavior never triggered on a machine without gh on PATH. The fix wraps the gh api call in try/except OSError, captures the failure reason either way (exception text or stderr/returncode), and always proceeds to the HTTPS fallback; the final combined error message now names both failure reasons when both routes fail.

Verification performed

• Read the full diff and the resulting scripts/sync-nlb-checker.py — the control flow correctly initializes gh_err on both the except OSError path and the else (subprocess ran) path before it's used in the final SystemExit message; no uninitialized-variable risk.
• Ran the new suite directly: python3 scripts/test_sync_nlb_checker.py → all 5 checks pass (missing-gh fallthrough, working-gh short-circuit, failing-gh fallthrough, and both both-fail cases naming the correct reason).
• Ran scripts/check-ascii-punctuation.py against both changed files → clean.
• The local scripts/check-test-suites-covered.py run reports test_sync_nlb_checker.py as unregistered — this is a false alarm caused by the gha#598 workflow-file fallback (this checkout's .github/workflows/validate.yml is restored from the default branch, not the PR). I fetched the actual PR-head commit (c0375bfa59a928f5b49885fdcdfe50f1ebdc718d) and confirmed its validate.yml does include the new Run sync-nlb-checker fetch tests step calling scripts/test_sync_nlb_checker.py (lines 110-111), matching the diff. So the registration claimed in the PR body is accurate; the coverage checker's on-disk failure is an artifact of the review sandbox, not a defect in the PR.
• Checked syntax validity of both files with ast.parse — fine.
• Confirmed no prior formal reviews exist on this PR (first pass).

Notes (non-blocking)

• The pre-existing "gh returns 0 but empty stdout" branch (proc.returncode == 0 and proc.stdout false) isn't covered by the new tests, but that branch predates this PR and is untouched by it — out of scope for this fix, which is specifically about the FileNotFoundError case from Catch FileNotFoundError when gh is missing in sync-nlb-checker _fetch #2338.

No CLAUDE.md violations, no bugs, no hallucinated APIs (uses only stdlib subprocess/urllib.request and existing repo conventions), and the change is small, well-scoped, and well-tested.

Verdict

Ready for merge

Structured Review Data (JSON)

{
  "schema_version": "1.0",
  "reviewer": "claude",
  "commit_sha": "c0375bfa59a928f5b49885fdcdfe50f1ebdc718d",
  "verdict": "CLEAN",
  "findings": []
}

Reviewed commit: c0375bf

[github-actions]

💰 Cost: $0.8005 (review) — run