We recently created a new "Build Your Own" template community in our sandbox and we were adding our script snippets in the builder for our analytics tool (click the settings cog -> advanced -> edit header markup)
It seems to be adding the communities URL into the url from the script tag which is new behavior.
the format of the script tag is (removed the information to identify the script) in the edit header markup section:
<script src=“//subdomain.domain.com/*/*/script.min.js” async></script>
On our production environment, if you view source of the community, it displays this link as it is and you can click and navigate to the actual script file url
In our Sandbox, with the same format for the edit header markup section, it's adding the full communities url to that script tag src= when you view source of the page.
I added this script url to "Content Security Policy Trusted Sites" in setup and in the communities builder "Trusted Sites for Scripts".
Any suggestions on how to get this url to load properly from the header markup?
I did try adding https: to the script src and removing async.