error "fetch failed" with v4.2.5

[cpanato]

Hello

we are getting this fetch failed for some PRs but not for others

failing Job: https://github.com/kubernetes/release/actions/runs/8497248972/job/23275606196?pr=3530 (pr kubernetes/release#3530)

passing job: https://github.com/kubernetes/release/actions/runs/8497320345/job/23275763959?pr=3532 (pr kubernetes/release#3532)

I cannot debug that much. Do y'all have any tips?

thanks!

[saschagrunert]

Same there:

• build(deps): bump golang.org/x/oauth2 from 0.18.0 to 0.19.0 kubernetes/release#3553: https://github.com/kubernetes/release/actions/runs/8563734968/job/23475905833?pr=3553
• build(deps): bump golang.org/x/net from 0.23.0 to 0.24.0 kubernetes/release#3552: https://github.com/kubernetes/release/actions/runs/8563733283/job/23475897247?pr=3552

[i-cannot-figure-out-a-good-nick]

I will bump this but also add that this seems to be present on several versions and not specific to the v4.2.5 release.

[xmudrii]

The issue we had in kubernetes/release with this action has been caused by harden-runner not allowing traffic to api.deps.dev:443. It appears that this action is accessing the api.deps.dev endpoint to check for vulnerabilities:

dependency-review-action/src/scorecard.ts

Line 71 in df5d74f

const depsDevAPIRoot = 'https://api.deps.dev'

See kubernetes/release#3642 for more details.

@cpanato Are we good to close this issue now?