Fix version comments after quoted strings

[kurtmckee]

When YAML strings are quoted, Dependabot fails to update trailing version comments. For example, Dependabot will update the SHA but not the "v2.1.0" comment below:

- uses: "actions/checkout@01aecccf739ca6ff86c0539fbc67a7a5007bbc81" # v2.1.0

This PR fixes the bug in the associated regex.

In addition, this PR removes a test case using a short SHA ("01aecc") that is no longer updated (a problem that the test suite doesn't notice) and isn't supported by GitHub Actions anymore.

It also updates a short-SHA-based test case ("01aecc#v2.1.0") to use a full-length SHA so that it is more likely to catch bugs that might be introduced.

Fixes #8125

[deivid-rodriguez]

Awesome, nice catch!

[kurtmckee]

My commit verification settings are causing the commits to be flagged as "Unverified". This won't be an issue if this is squash-merged, but if not then I can rebase on main to ensure the branch is up-to-date and has valid GPG signatures.

Let me know if that would be helpful, depending on how PRs are merged. 👍

[deivid-rodriguez]

I was planning to use standard Merge, so feel free to rebase, thanks! 🙏

[kurtmckee]

Thanks for your patience! I've rebased on main and force-pushed. I'll monitor the test suite runs, but please let me know if this needs any additional work!

[kurtmckee]

Test suite has passed. 🥳

[deivid-rodriguez]

@kurtmckee I just deployed this, would you be able to confirm it's now working properly?

[kurtmckee]

I don't know how to check that except to wait for Dependabot's scheduled checks on a given repo.

Is there a way to trigger Dependabot against a specific repository? If not, I can set up a situation where this gets tested against a test repo.

Edit: Just realized I can create a test repo with out-of-date action versions and then enable Dependabot. I'll test this out and respond back!

[deivid-rodriguez]

That works!

Also, if you go to "Insights > Dependency Graph > Dependabot" of an existing repo with dependabot enabled, you should be able to manually check for updates.

Also, on an existing PR where this bug was triggered, commenting @dependabot recreate should retry using the new code.

[kurtmckee]

This appears to be working! 🥳

[deivid-rodriguez]

Awesome! Can you rebase one last time? We require up to date PRs for merging and one other PR sneaked into main while you were testing this 😅

[kurtmckee]

No worries at all. Thanks for sharing how to manually check for updates!

[deivid-rodriguez]

Thanks so much for the fix!