[BUG] Error "fetch failed" when using proxy

[lindeberg]

Describe the bug
Error "fetch failed" when using proxy on a self-hosted runner with a proxy with least privelege network access, and these domains are allowed:

• api.deps.dev
• api.securityscorecards.dev

2024-08-16T06:36:11.3271510Z Dependency review did not detect any denied packages
2024-08-16T06:36:31.3476555Z ##[error]fetch failed

To Reproduce
Steps to reproduce the behavior:

1. Set up a self-hosted runner with least privelege network access

      - name: Dependency Review
        uses: actions/dependency-review-action@v4
        with:
          fail-on-severity: low
          license-check: false

2. Allow the domains above
3. Run dependency-review such that it triggers calls to these domains
4. See the error

Expected behavior
It should be all good!

Screenshots

Action version
v4.3.4

[bteng22]

Hey @lindeberg thanks for reporting this. If you disable the OpenSSF scorecards does the fetch still fail? show-openssf-scorecard: false Trying to narrow down the causes here

[lindeberg]

Failing still with show-openssf-scorecard: false:

[gadzet]

We experience this issue as well using proxy. Rolling back to actions/[email protected] works. It seems like issue is introduced when upgrading to node 20.

[bisdevres]

confirming @gadzet's remak.
v3.1.4 (and the more recent v3.1.5) work for me.

Note

the culprit of this issue as 2 blocked URL's on our firewall:

• api.deps.dev
• api.securityscorecards.dev

after a whitelist, we could use v4 again.

[jsattler]

We are facing the same issue and I can confirm that downgrading from v4 -> v3 solves it. Our runner is behind a proxy. Doing the same requests with curl works just fine.