What

Fix Dependency Review reporting GitHub Actions dependencies as having an unknown license when the Dependency Graph response does not include a license or source repository URL.

This was encountered while investigating ossf/scorecard#5090, where Dependency Review reported dependencies such as actions/cache as having an unknown license even though the repository has a valid license.

Why

For some GitHub Actions dependencies, the Dependency Graph API can return both license: null and source_repository_url: null.

In these cases, the package URL still contains the GitHub repository information. For example:

pkg:githubactions/actions/cache@6.%2A.%2A

The existing license fallback relies on source_repository_url, so the logic classifies these dependencies as unlicensed without attempting to fetch their repository license.

How

Add a fallback for githubactions package URLs when source_repository_url is unavailable.

Derive the GitHub repository owner and name from the PURL, then use the existing GitHub license API lookup to fetch the repository license.

The existing source_repository_url behavior remains unchanged.

Test

Add a regression test for an actions/cache dependency with:

license: null
source_repository_url: null
package_url: pkg:githubactions/actions/cache@6.%2A.%2A

The test verifies that the fallback calls the GitHub license API with:

owner: actions
repo: cache

The test also verifies that the fallback no longer classifies the dependency as unlicensed.

All existing tests pass:

Test Suites: 12 passed, 12 total
Tests:       199 passed, 199 total