stub out gh-auth to avoid $GITHUB_AUTH dependency, also ensure no web requests