[BUG] Error "fetch failed" when using proxy

[lindeberg]

Describe the bug
Error "fetch failed" when using proxy on a self-hosted runner with a proxy with least privelege network access, and these domains are allowed:

• api.deps.dev
• api.securityscorecards.dev

2024-08-16T06:36:11.3271510Z Dependency review did not detect any denied packages
2024-08-16T06:36:31.3476555Z ##[error]fetch failed

To Reproduce
Steps to reproduce the behavior:

1. Set up a self-hosted runner with least privelege network access

      - name: Dependency Review
        uses: actions/dependency-review-action@v4
        with:
          fail-on-severity: low
          license-check: false

2. Allow the domains above
3. Run dependency-review such that it triggers calls to these domains
4. See the error

Expected behavior
It should be all good!

Screenshots

Action version
v4.3.4

[bteng22]

Hey @lindeberg thanks for reporting this. If you disable the OpenSSF scorecards does the fetch still fail? show-openssf-scorecard: false Trying to narrow down the causes here

[lindeberg]

Failing still with show-openssf-scorecard: false:

[gadzet]

We experience this issue as well using proxy. Rolling back to actions/dependency-review-action@v3.1.4 works. It seems like issue is introduced when upgrading to node 20.

[bisdevres]

confirming @gadzet's remak.
v3.1.4 (and the more recent v3.1.5) work for me.

Note

the culprit of this issue as 2 blocked URL's on our firewall:

• api.deps.dev
• api.securityscorecards.dev

after a whitelist, we could use v4 again.

[jsattler]

We are facing the same issue and I can confirm that downgrading from v4 -> v3 solves it. Our runner is behind a proxy. Doing the same requests with curl works just fine.

[github-actions]

👋 This issue has been marked as stale because it has been open with no activity for 180 days. You can: comment on the issue or remove the stale label to hold stalebot off for a while, add the Keep label to hold stale off permanently, or do nothing. If you do nothing, this issue will be closed eventually by the stalebot. Please see CONTRIBUTING.md for more policy details.

[github-actions]

👋 This issue has been closed by stalebot because it has been open with no activity for over 180 days. Please see CONTRIBUTING.md for more policy details.