This means that any future incompatibilities in the script will break workflows using old versions of the action. It's also not clear that you need to download the script. The action repository will have been checked out on the runner in order to invoke the action, so we should already have the script. You should be able to build a path to it relative to the JS script file:
The action downloads a copy of the
lp_cla_check.py
from the tip of the main branch:https://github.com/canonical/has-signed-canonical-cla/blob/c4e25ca57be6bc0bd08ef5eae1a068c0d486ead1/index.js#L18-L21
This means that any future incompatibilities in the script will break workflows using old versions of the action. It's also not clear that you need to download the script. The action repository will have been checked out on the runner in order to invoke the action, so we should already have the script. You should be able to build a path to it relative to the JS script file: