Gitleaks Summary Generated Urls Broken

[Tjhayhay]

Heyo!

The gitleaks summary is generating urls that are broken for all my private Org repos for all workflow event types.

The Url generated for example is https://github.com///actions/runs/undefined/commit/21f3bb48c90c82c688feb801ed5d539a6472273b

If I take out the "actions/runs/undefined" part of the url it seems to at least land on the commit page.

Any ideas whats happening here?

It seems odd because the url seems like it should be created based off eventJSON.repository.html_url and when I view that in the pipeline it looks correct without the actions/runs/undefined bit added.

[acidghost]

The URL is taken from

gitleaks-action/src/summary.js

Line 9 in dea2b73

const repo_url = eventJSON.repository.html_url;

But unfortunately it's overwritten if the workflow is scheduled with a cron (i.e. event type schedule)

gitleaks-action/src/index.js

Lines 51 to 59 in dea2b73

	// eventJSON.repository is undefined for scheduled events
	if (eventType == "schedule") {
	githubUsername = process.env.GITHUB_REPOSITORY_OWNER;
	eventJSON.repository = {
	owner: {
	login: process.env.GITHUB_REPOSITORY_OWNER,
	},
	full_name: process.env.GITHUB_REPOSITORY,
	};

I have tested privately that the JSON file read into eventJSON contains repository.html_url, so IMO that if branch is obsolete and can be removed. Unfortunately I'm unable to find documentation to back this up...