GitHub Actions dependencies reported as "unknown license" despite having valid MIT licenses

[iemejia]

Bug Description

OpenSSF Scorecard reports GitHub Actions packages as having "unknown licenses" in the dependency review, even though all referenced actions have valid, properly detected licenses (MIT) in their repositories.

Affected packages

Package	Actual License	License file
actions/checkout	MIT	https://github.com/actions/checkout/blob/main/LICENSE
actions/cache	MIT	https://github.com/actions/cache/blob/main/LICENSE
actions/setup-node	MIT	https://github.com/actions/setup-node/blob/main/LICENSE
actions/dependency-review-action	MIT	https://github.com/actions/dependency-review-action/blob/main/LICENSE

GitHub's own API (repos/{owner}/{repo} → .license.spdx_id) correctly identifies all of these as MIT-licensed.

Steps to reproduce

1. Create a repository that uses standard GitHub Actions (e.g., actions/checkout@v6, actions/cache@v5)
2. Run Scorecard against the repository
3. Observe that the license check flags these actions as "packages with unknown licenses"

Expected behavior

Scorecard should recognize licenses for github-actions ecosystem packages by querying the upstream repository metadata, since GitHub correctly exposes license information via its API.

Actual behavior

Scorecard reports these well-known, MIT-licensed GitHub Actions as having unknown licenses, creating false-positive warnings.

Additional context

Repository where observed: https://github.com/iemejia/fabio-skills

This appears to be a gap in how Scorecard resolves licenses for the pkg:githubactions/ purl ecosystem compared to other ecosystems (npm, pip, etc.).