fix: handle quote delimeter for pin actions

Author: shubham-stepsecurity

remediation/workflow/pin/pinactions.go

@@ -105,7 +105,7 @@ func PinAction(action, inputYaml string, exemptedActions []string, pinToImmutabl
 	// - "actions/checkout@v1""    - Matches (quote delimiter)
 	// - "actions/checkout@v1"     - Matches (quote delimiter)
 	// - "actions/checkout@v1\n"   - Matches (newline is considered whitespace \s)
-	actionRegex := regexp.MustCompile(`(` + regexp.QuoteMeta(action) + `)($|\s|"|')`)
+	actionRegex := regexp.MustCompile(`((?:["'])?` + regexp.QuoteMeta(action) + `(?:["'])?)($|\s|"|')`)
 	inputYaml = actionRegex.ReplaceAllString(inputYaml, pinnedAction+"$2")
 	yamlWithPreviousActionCommentsRemoved, wasModified := removePreviousActionComments(pinnedAction, inputYaml)
 	if wasModified {

remediation/workflow/pin/pinactions_test.go

@@ -295,6 +295,7 @@ func TestPinActions(t *testing.T) {
 		{fileName: "immutableaction-1.yml", wantUpdated: true, pinToImmutable: true},
 		{fileName: "exemptaction.yml", wantUpdated: true, exemptedActions: []string{"actions/checkout", "rohith/*"}, pinToImmutable: true},
 		{fileName: "donotpintoimmutable.yml", wantUpdated: true, pinToImmutable: false},
+		{fileName: "invertedcommas.yml", wantUpdated: true, pinToImmutable: false},
 	}
 	for _, tt := range tests {
 		input, err := ioutil.ReadFile(path.Join(inputDirectory, tt.fileName))

testfiles/pinactions/input/invertedcommas.yml

@@ -0,0 +1,15 @@
+name: "close issue"
+
+on:
+  push:
+
+jobs:
+  closeissue:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Close Issue
+        uses: "peter-evans/close-issue@v1"
+        with:
+          issue-number: 1
+          comment: Auto-closing issue

testfiles/pinactions/output/invertedcommas.yml

@@ -0,0 +1,15 @@
+name: "close issue"
+
+on:
+  push:
+
+jobs:
+  closeissue:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Close Issue
+        uses: peter-evans/close-issue@a700eac5bf2a1c7a8cb6da0c13f93ed96fd53dbe # v1.0.3
+        with:
+          issue-number: 1
+          comment: Auto-closing issue