bumping to 4.2.4

Bug fixes to #718

.devcontainer/devcontainer.json

@@ -2,5 +2,8 @@
   "name": "Dependency Review Action",
   "image": "mcr.microsoft.com/devcontainers/typescript-node:18",
   "postCreateCommand": "npm install",
-  "remoteUser": "node"
+  "remoteUser": "node",
+  "features": {
+    "ghcr.io/devcontainers/features/ruby:1": {}
+  }
 }

README.md

@@ -171,7 +171,7 @@ The Dependency Review GitHub Action check will only block a pull request from be
 > Action outputs are unicode strings [with a 1MB size limit](https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#outputs-for-docker-container-and-javascript-actions).
 
 > [!IMPORTANT]
-> If you use these outputs in a run-step, you must store the ouput data in an envrioment variable instead of using the output directly. Using an output directly might break shell scripts. For example:
+> If you use these outputs in a run-step, you must store the output data in an environment variable instead of using the output directly. Using an output directly might break shell scripts. For example:
 >
 > ```yaml
 > env:

__tests__/scorecard.test.ts

@@ -22,6 +22,19 @@ const npmChange: Change = {
   ]
 }
 
+const actionsChange: Change = {
+  manifest: 'workflow.yml',
+  change_type: 'added',
+  ecosystem: 'actions',
+  name: 'actions/checkout/',
+  version: 'v3',
+  package_url: 'pkg:githubactions/actions@v3',
+  license: 'MIT',
+  source_repository_url: 'null',
+  scope: 'runtime',
+  vulnerabilities: []
+}
+
 test('Get scorecard from API', async () => {
   const changes: Changes = [npmChange]
   const scorecard = await getScorecardLevels(changes)
@@ -38,3 +51,11 @@ test('Get project URL from deps.dev API', async () => {
   )
   expect(result).not.toBeNull()
 })
+
+test('Handles Actions special case', async () => {
+  const changes: Changes = [actionsChange]
+  const result = await getScorecardLevels(changes)
+  expect(result).not.toBeNull()
+  expect(result.dependencies).toHaveLength(1)
+  expect(result.dependencies[0].scorecard?.score).toBeGreaterThan(0)
+})

dist/index.js

@@ -1043,8 +1043,15 @@ function getScorecardLevels(changes) {
             if (repositoryUrl === null || repositoryUrl === void 0 ? void 0 : repositoryUrl.startsWith('https://')) {
                 repositoryUrl = repositoryUrl.replace('https://', '');
             }
+            // Handle the special case for GitHub Actions, where the repository URL is null
+            if (ecosystem === 'actions') {
+                // The package name for GitHub Actions in the API is in the format `owner/repo/`, so we can use that to get the repository URL
+                // If the package name has more than 2 slashes, it's referencing a sub-action, and we need to strip the last part out
+                const parts = packageName.split('/');
+                repositoryUrl = `github.com/${parts[0]}/${parts[1]}`; // e.g. github.com/actions/checkout
+            }
             // If GitHub API doesn't have the repository URL, query deps.dev for it.
-            if (repositoryUrl) {
+            if (!repositoryUrl) {
                 // Call the deps.dev API to get the repository URL from there
                 repositoryUrl = yield getProjectUrl(ecosystem, packageName, version);
             }
@@ -1069,7 +1076,7 @@ function getScorecardLevels(changes) {
 exports.getScorecardLevels = getScorecardLevels;
 function getScorecard(repositoryUrl) {
     return __awaiter(this, void 0, void 0, function* () {
-        const apiRoot = 'https://api.securityscorecards.dev/';
+        const apiRoot = 'https://api.securityscorecards.dev';
         let scorecardResponse = {};
         const url = `${apiRoot}/projects/${repositoryUrl}`;
         const response = yield fetch(url);

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "dependency-review-action",
-  "version": "4.2.3",
+  "version": "4.2.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "dependency-review-action",
-      "version": "4.2.3",
+      "version": "4.2.4",
       "license": "MIT",
       "dependencies": {
         "@actions/core": "^1.10.1",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "dependency-review-action",
-  "version": "4.2.3",
+  "version": "4.2.4",
   "private": true,
   "description": "A GitHub Action for Dependency Review",
   "main": "lib/main.js",

src/scorecard.ts

@@ -17,8 +17,16 @@ export async function getScorecardLevels(
       repositoryUrl = repositoryUrl.replace('https://', '')
     }
 
+    // Handle the special case for GitHub Actions, where the repository URL is null
+    if (ecosystem === 'actions') {
+      // The package name for GitHub Actions in the API is in the format `owner/repo/`, so we can use that to get the repository URL
+      // If the package name has more than 2 slashes, it's referencing a sub-action, and we need to strip the last part out
+      const parts = packageName.split('/')
+      repositoryUrl = `github.com/${parts[0]}/${parts[1]}` // e.g. github.com/actions/checkout
+    }
+
     // If GitHub API doesn't have the repository URL, query deps.dev for it.
-    if (repositoryUrl) {
+    if (!repositoryUrl) {
       // Call the deps.dev API to get the repository URL from there
       repositoryUrl = await getProjectUrl(ecosystem, packageName, version)
     }
@@ -41,7 +49,7 @@ export async function getScorecardLevels(
 }
 
 async function getScorecard(repositoryUrl: string): Promise<ScorecardApi> {
-  const apiRoot = 'https://api.securityscorecards.dev/'
+  const apiRoot = 'https://api.securityscorecards.dev'
   let scorecardResponse: ScorecardApi = {} as ScorecardApi
 
   const url = `${apiRoot}/projects/${repositoryUrl}`