BUG api.securityscorecards.dev returning wrong documentation link for CII best practices

[Abdur-rahmaanJ]

Describe the bug https://api.securityscorecards.dev/projects/github.com/pyhoneybot/honeybot returns among others

{
      "details": null,
      "score": 0,
      "reason": "no badge detected",
      "name": "CII-Best-Practices",
      "documentation": {
        "url": "https://github.com/ossf/scorecard/blob/3155d134e59d8f47261b1ae9d143034c69572227/docs/checks.md#cii-best-practices",
        "short": "Determines if the project has a CII Best Practices Badge."
      }
    },

But, https://github.com/ossf/scorecard/blob/3155d134e59d8f47261b1ae9d143034c69572227/docs/checks.md#cii-best-practices does not return anything

Json output: honeybot.txt

[azeemshaikh38]

Interesting find. For some reason the commitSHA points to a commit in scorecard-action repo - https://github.com/ossf/scorecard-action/commit/3155d134e59d8f47261b1ae9d143034c69572227. Need to investigate more. Thanks for the report.

[Abdur-rahmaanJ]

Np i am a bit lazy to dive in myself

[raghavkaul]

Looks like a problem with how scorecard-action propagates runtime environment to scorecard. I can take a look further

[spencerschrock]

Not sure when this was fixed, but no longer occurring as of December 2022 ish. https://api.securityscorecards.dev/projects/github.com/ossf/scorecard?commit=9e6870cc4cc40ef542651d0775c0888163f05e17