Branch protection protects branches that are not listed in rfc-0015

[stephanme]

Branch protection automation protected the following branches for cf-deployment:

• update-java-buildpack-release-4.56
• develop
• main
• manual_merge_stemcell_update_from_main
• update-cf-cli-release-v1.43.0

It should have protected only the main branch from this list. Looks like the branch protection protects all branches that include main (the default branch of cf-deployment) or v (from pattern v[0-9]*).

Reason seems to be that the inclusionPattern is checked with regexp.MatchString by the branchprotector tool.

MatchString reports whether the string s contains any match of the regular expression pattern.

https://github.com/cloudfoundry/community/actions/runs/4677029281/jobs/8284059449

...
{"component":"branchprotector","file":"k8s.io/test-infra/prow/cmd/branchprotector/protect.go:329","func":"main.(*protector).UpdateRepo","level":"info","msg":"cloudfoundry/cf-deployment=update-windows-utilities-release-0.19.0: not included","severity":"info","time":"2023-04-12T13:16:40Z"}
{"client":"github","component":"branchprotector","file":"k8s.io/test-infra/prow/github/client.go:918","func":"k8s.io/test-infra/prow/github.(*client).log","level":"info","msg":"GetBranches(cloudfoundry, cf-deployment, true)","severity":"info","time":"2023-04-12T13:16:40Z"}
{"component":"branchprotector","file":"k8s.io/test-infra/prow/cmd/branchprotector/protect.go:329","func":"main.(*protector).UpdateRepo","level":"info","msg":"cloudfoundry/cf-deployment=release-candidate: not included","severity":"info","time":"2023-04-12T13:16:40Z"}
{"client":"github","component":"branchprotector","file":"k8s.io/test-infra/prow/github/client.go:918","func":"k8s.io/test-infra/prow/github.(*client).log","level":"info","msg":"GetBranchProtection(cloudfoundry, cf-deployment, update-java-buildpack-release-4.56)","severity":"info","time":"2023-04-12T13:16:40Z"}
{"client":"github","component":"branchprotector","file":"k8s.io/test-infra/prow/github/client.go:918","func":"k8s.io/test-infra/prow/github.(*client).log","level":"info","msg":"GetBranchProtection(cloudfoundry, cf-deployment, develop)","severity":"info","time":"2023-04-12T13:16:40Z"}
{"client":"github","component":"branchprotector","file":"k8s.io/test-infra/prow/github/client.go:918","func":"k8s.io/test-infra/prow/github.(*client).log","level":"info","msg":"GetBranchProtection(cloudfoundry, cf-deployment, main)","severity":"info","time":"2023-04-12T13:16:40Z"}
{"client":"github","component":"branchprotector","file":"k8s.io/test-infra/prow/github/client.go:918","func":"k8s.io/test-infra/prow/github.(*client).log","level":"info","msg":"GetBranchProtection(cloudfoundry, cf-deployment, manual_merge_stemcell_update_from_main)","severity":"info","time":"2023-04-12T13:16:40Z"}
{"client":"github","component":"branchprotector","file":"k8s.io/test-infra/prow/github/client.go:918","func":"k8s.io/test-infra/prow/github.(*client).log","level":"info","msg":"GetBranchProtection(cloudfoundry, cf-deployment, update-cf-cli-release-v1.43.0)","severity":"info","time":"2023-04-12T13:16:40Z"}
...

[stephanme]

Idea is to surround the branch inclusion patterns by ^...$ to get a full branch name match.

#581 will test this on https://github.com/cloudfoundry/branchprotection-test. Once merged, I will create test branches similar to the ones listed above which should not be touched anymore. If it works as expected, I adapt the org automation.

[stephanme]

Test #581 succeeded. I created a few test branches on repo branchprotection-test similar to the problematic ones on cf-deployment and the remained unprotected after an org automation run:

https://github.com/cloudfoundry/community/actions/runs/4694888643/jobs/8323476572

...
{"client":"github","component":"branchprotector","file":"k8s.io/test-infra/prow/github/client.go:918","func":"k8s.io/test-infra/prow/github.(*client).log","level":"info","msg":"GetRepo(cloudfoundry, branchprotection-test)","severity":"info","time":"2023-04-14T06:36:00Z"}
{"client":"github","component":"branchprotector","file":"k8s.io/test-infra/prow/github/client.go:918","func":"k8s.io/test-infra/prow/github.(*client).log","level":"info","msg":"GetBranches(cloudfoundry, branchprotection-test, false)","severity":"info","time":"2023-04-14T06:36:01Z"}
{"component":"branchprotector","file":"k8s.io/test-infra/prow/cmd/branchprotector/protect.go:329","func":"main.(*protector).UpdateRepo","level":"info","msg":"cloudfoundry/branchprotection-test=develop: not included","severity":"info","time":"2023-04-14T06:36:01Z"}
{"component":"branchprotector","file":"k8s.io/test-infra/prow/cmd/branchprotector/protect.go:329","func":"main.(*protector).UpdateRepo","level":"info","msg":"cloudfoundry/branchprotection-test=manual_merge_stemcell_update_from_main: not included","severity":"info","time":"2023-04-14T06:36:01Z"}
{"component":"branchprotector","file":"k8s.io/test-infra/prow/cmd/branchprotector/protect.go:329","func":"main.(*protector).UpdateRepo","level":"info","msg":"cloudfoundry/branchprotection-test=stephanme-patch-1: not included","severity":"info","time":"2023-04-14T06:36:01Z"}
{"component":"branchprotector","file":"k8s.io/test-infra/prow/cmd/branchprotector/protect.go:329","func":"main.(*protector).UpdateRepo","level":"info","msg":"cloudfoundry/branchprotection-test=test: not included","severity":"info","time":"2023-04-14T06:36:01Z"}
{"component":"branchprotector","file":"k8s.io/test-infra/prow/cmd/branchprotector/protect.go:329","func":"main.(*protector).UpdateRepo","level":"info","msg":"cloudfoundry/branchprotection-test=update-cf-cli-release-v1.43.0: not included","severity":"info","time":"2023-04-14T06:36:01Z"}
{"client":"github","component":"branchprotector","file":"k8s.io/test-infra/prow/github/client.go:918","func":"k8s.io/test-infra/prow/github.(*client).log","level":"info","msg":"GetBranches(cloudfoundry, branchprotection-test, true)","severity":"info","time":"2023-04-14T06:36:01Z"}
{"client":"github","component":"branchprotector","file":"k8s.io/test-infra/prow/github/client.go:918","func":"k8s.io/test-infra/prow/github.(*client).log","level":"info","msg":"GetBranchProtection(cloudfoundry, branchprotection-test, main)","severity":"info","time":"2023-04-14T06:36:01Z"}
{"client":"github","component":"branchprotector","file":"k8s.io/test-infra/prow/github/client.go:918","func":"k8s.io/test-infra/prow/github.(*client).log","level":"info","msg":"GetBranchProtection(cloudfoundry, branchprotection-test, v1)","severity":"info","time":"2023-04-14T06:36:01Z"}
{"client":"github","component":"branchprotector","file":"k8s.io/test-infra/prow/github/client.go:918","func":"k8s.io/test-infra/prow/github.(*client).log","level":"info","msg":"UpdateBranchProtection(cloudfoundry, branchprotection-test, main, {\"required_status_checks\":null,\"enforce_admins\":true,\"required_pull_request_reviews\":{\"dismissal_restrictions\":{},\"dismiss_stale_reviews\":true,\"require_code_owner_reviews\":true,\"required_approving_review_count\":1,\"bypass_pull_request_allowances\":{\"users\":[],\"teams\":[\"wg-app-runtime-deployments-bots\"]}},\"restrictions\":null,\"required_linear_history\":false,\"allow_force_pushes\":false,\"allow_deletions\":false})","severity":"info","time":"2023-04-14T06:36:01Z"}
{"client":"github","component":"branchprotector","file":"k8s.io/test-infra/prow/github/client.go:918","func":"k8s.io/test-infra/prow/github.(*client).log","level":"info","msg":"UpdateBranchProtection(cloudfoundry, branchprotection-test, v1, {\"required_status_checks\":null,\"enforce_admins\":true,\"required_pull_request_reviews\":{\"dismissal_restrictions\":{},\"dismiss_stale_reviews\":true,\"require_code_owner_reviews\":true,\"required_approving_review_count\":1,\"bypass_pull_request_allowances\":{\"users\":[],\"teams\":[\"wg-app-runtime-deployments-bots\"]}},\"restrictions\":null,\"required_linear_history\":false,\"allow_force_pushes\":false,\"allow_deletions\":false})","severity":"info","time":"2023-04-14T06:36:01Z"}
...

I will file a PR to adapt the org automation coding to generate branch protection include patterns surrounded by ^...$.