Invalid URL for OpenSSF Scorecard Package

[dupuy]

In the latest update to this action, the OpenSSF Scorecard table generated by the dependency review action for the dependabot PR in my project's repo to update the version of that action, I get incorrect labels with invalid URLs:

actions/actions/dependency-review-action

[actions/actions/dependency-review-action](https://https//github.com/actions/dependency-review-action)

As you can see, actions/ is repeated in the anchor text. I'm not sure how or where in the code this is happening.

I suspect the invalid URL is due to a faulty URL in the data (so, not necessarily a bug in the code), but I'm not sure where in the data this mistake (missing : after https in URL) was made.

However, the code in src/scorecard.ts is already messing with the URL:

   //If the repository_url includes the protocol, remove it
    if (repositoryUrl?.startsWith('https://')) {
      repositoryUrl = repositoryUrl.replace('https://', '')
    }

The logic here could be enhanced to handle this not-uncommon error (as well as the possibility of an insecure http: prefix). This might best be done by using a regex like https?:?// for the check and replace.

[dupuy]

@jhutchings1 as this is your code, you may be the best person to address this issue

And looking at the table and the logs, I suspect the bad URL may also be causing failure to get the "Score" and "Details" column data (all show "Unknown").

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/dependency-review-action	0fa40c3	Unknown	Unknown
actions/actions/dependency-review-action	9129d7d	Unknown	Unknown

[jhutchings1]

👋 @dupuy Thanks for reporting this. I did have a couple of bugs here around the way I was building the query URL.

The actions/actions piece in the UI is actually by design (one could question whether it's a good one or not!). That's trying to show dependencies as {ecosystem}/{package} and packages in Actions are nwo based, meaning the ones in the actions org are going to show with that actions/actions prefix.

It'll be fixed by #725

[febuiles]

@jhutchings1 thank you for the fix, it's been released in 4.2.4.