Actions lockfiles: match repository casing

Author: nodeselector

actions/ql/lib/codeql/actions/Lock.qll

@@ -25,11 +25,10 @@ class ActionsLock extends YamlDocument {
       pin = pinNode.getValue() and
       pinnedNwo = pin.regexpCapture("^([^/@:]+/[^/@:]+)@([^:]+)$", 1) and
       ref = pin.regexpCapture("^([^/@:]+/[^/@:]+)@([^:]+)$", 2) and
-      pinnedNwo = pinnedNwo.toLowerCase() and
       (
-        nwo.toLowerCase() = pinnedNwo
+        nwo.toLowerCase() = pinnedNwo.toLowerCase()
         or
-        nwo.toLowerCase().prefix(pinnedNwo.length() + 1) = pinnedNwo + "/"
+        nwo.toLowerCase().prefix(pinnedNwo.length() + 1) = pinnedNwo.toLowerCase() + "/"
       ) and
       root.lookup("dependencies").(YamlMapping).lookup(pin) = dependency and
       dependency.lookup("ref").(YamlScalar).getValue() = ref and

actions/ql/test/query-tests/Security/CWE-829-Lockfile/.github/workflows/actions.lock

@@ -1,14 +1,14 @@
 version: future-version
 workflows:
   .github/workflows/rust-ci.yml:
-    - dtolnay/rust-toolchain@v1
+    - DToLnAy/RuSt-ToOlChAiN@v1
     - mismatched/action@v1
     - malformed/action@v1
     - missing/action@v1
   .github/workflows/other.yml:
     - other-workflow/action@v1
 dependencies:
-  dtolnay/rust-toolchain@v1:
+  DToLnAy/RuSt-ToOlChAiN@v1:
     ref: v1
     commit: sha1-6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
     owner_id: 1940490