Remove Ruby from devcontainer

.devcontainer/devcontainer.json

@@ -2,8 +2,5 @@
   "name": "Dependency Review Action",
   "image": "mcr.microsoft.com/devcontainers/typescript-node:18",
   "postCreateCommand": "npm install",
-  "remoteUser": "node",
-  "features": {
-    "ghcr.io/devcontainers/features/ruby:1": {}
-  }
+  "remoteUser": "node"
 }

README.md

@@ -171,7 +171,7 @@ The Dependency Review GitHub Action check will only block a pull request from be
 > Action outputs are unicode strings [with a 1MB size limit](https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#outputs-for-docker-container-and-javascript-actions).
 
 > [!IMPORTANT]
-> If you use these outputs in a run-step, you must store the output data in an environment variable instead of using the output directly. Using an output directly might break shell scripts. For example:
+> If you use these outputs in a run-step, you must store the ouput data in an envrioment variable instead of using the output directly. Using an output directly might break shell scripts. For example:
 >
 > ```yaml
 > env:

__tests__/scorecard.test.ts

@@ -22,19 +22,6 @@ const npmChange: Change = {
   ]
 }
 
-const actionsChange: Change = {
-  manifest: 'workflow.yml',
-  change_type: 'added',
-  ecosystem: 'actions',
-  name: 'actions/checkout/',
-  version: 'v3',
-  package_url: 'pkg:githubactions/actions@v3',
-  license: 'MIT',
-  source_repository_url: 'null',
-  scope: 'runtime',
-  vulnerabilities: []
-}
-
 test('Get scorecard from API', async () => {
   const changes: Changes = [npmChange]
   const scorecard = await getScorecardLevels(changes)
@@ -51,11 +38,3 @@ test('Get project URL from deps.dev API', async () => {
   )
   expect(result).not.toBeNull()
 })
-
-test('Handles Actions special case', async () => {
-  const changes: Changes = [actionsChange]
-  const result = await getScorecardLevels(changes)
-  expect(result).not.toBeNull()
-  expect(result.dependencies).toHaveLength(1)
-  expect(result.dependencies[0].scorecard?.score).toBeGreaterThan(0)
-})

dist/index.js

@@ -1043,15 +1043,8 @@ function getScorecardLevels(changes) {
             if (repositoryUrl === null || repositoryUrl === void 0 ? void 0 : repositoryUrl.startsWith('https://')) {
                 repositoryUrl = repositoryUrl.replace('https://', '');
             }
-            // Handle the special case for GitHub Actions, where the repository URL is null
-            if (ecosystem === 'actions') {
-                // The package name for GitHub Actions in the API is in the format `owner/repo/`, so we can use that to get the repository URL
-                // If the package name has more than 2 slashes, it's referencing a sub-action, and we need to strip the last part out
-                const parts = packageName.split('/');
-                repositoryUrl = `github.com/${parts[0]}/${parts[1]}`; // e.g. github.com/actions/checkout
-            }
             // If GitHub API doesn't have the repository URL, query deps.dev for it.
-            if (!repositoryUrl) {
+            if (repositoryUrl) {
                 // Call the deps.dev API to get the repository URL from there
                 repositoryUrl = yield getProjectUrl(ecosystem, packageName, version);
             }
@@ -1076,7 +1069,7 @@ function getScorecardLevels(changes) {
 exports.getScorecardLevels = getScorecardLevels;
 function getScorecard(repositoryUrl) {
     return __awaiter(this, void 0, void 0, function* () {
-        const apiRoot = 'https://api.securityscorecards.dev';
+        const apiRoot = 'https://api.securityscorecards.dev/';
         let scorecardResponse = {};
         const url = `${apiRoot}/projects/${repositoryUrl}`;
         const response = yield fetch(url);

src/scorecard.ts

@@ -17,16 +17,8 @@ export async function getScorecardLevels(
       repositoryUrl = repositoryUrl.replace('https://', '')
     }
 
-    // Handle the special case for GitHub Actions, where the repository URL is null
-    if (ecosystem === 'actions') {
-      // The package name for GitHub Actions in the API is in the format `owner/repo/`, so we can use that to get the repository URL
-      // If the package name has more than 2 slashes, it's referencing a sub-action, and we need to strip the last part out
-      const parts = packageName.split('/')
-      repositoryUrl = `github.com/${parts[0]}/${parts[1]}` // e.g. github.com/actions/checkout
-    }
-
     // If GitHub API doesn't have the repository URL, query deps.dev for it.
-    if (!repositoryUrl) {
+    if (repositoryUrl) {
       // Call the deps.dev API to get the repository URL from there
       repositoryUrl = await getProjectUrl(ecosystem, packageName, version)
     }
@@ -49,7 +41,7 @@ export async function getScorecardLevels(
 }
 
 async function getScorecard(repositoryUrl: string): Promise<ScorecardApi> {
-  const apiRoot = 'https://api.securityscorecards.dev'
+  const apiRoot = 'https://api.securityscorecards.dev/'
   let scorecardResponse: ScorecardApi = {} as ScorecardApi
 
   const url = `${apiRoot}/projects/${repositoryUrl}`