Don't update protected flag if unprotected

In I4cc3ab2fc795aa1fc49293de1a3feb28c969cc35 we changed the branch cache
update decision to not update the protected flag for missing projects.

However, we introduced a small regression in that we also update the
branch cache if the branch is unprotected and wasn't protected before.

When there is no branch information and the branch is not protected we
can simply skip the update.

Change-Id: Icbbd22bd4cac87b0a232407653b51a9abe075398

tests/unit/test_github_driver.py

@@ -2069,6 +2069,43 @@ class TestGithubUnprotectedBranches(ZuulTestCase):
             self.waitUntilSettled()
             cache_mock.assert_not_called()
 
+    def test_push_event_unprotected_branch_cache_update(self):
+        # Test that we do not update the branch cache for events on
+        # unprotected branches when exclude-unprotected-branches is
+        # configured.
+        self.create_branch('org/project2', 'feature')
+        github = self.fake_github.getGithubClient()
+        repo = github.repo_from_project('org/project2')
+        repo._set_branch_protection('master', True)
+        repo._create_branch('feature')
+
+        with (mock.patch(
+                "zuul.zk.branch_cache_new.BranchCacheNew.setProtected")
+              as cache_mock):
+            self.fake_github.emitEvent(
+                self.fake_github.getPushEvent(
+                    'org/project2',
+                    ref='refs/heads/feature'))
+            self.waitUntilSettled()
+            cache_mock.assert_not_called()
+
+    def test_push_event_protected_branch_cache_update(self):
+        # Test that we do not update the branch cache for events on
+        # protected branches when the protected state did not change.
+        github = self.fake_github.getGithubClient()
+        repo = github.repo_from_project('org/project2')
+        repo._set_branch_protection('master', True)
+
+        with (mock.patch(
+                "zuul.zk.branch_cache_new.BranchCacheNew.setProtected")
+              as cache_mock):
+            self.fake_github.emitEvent(
+                self.fake_github.getPushEvent(
+                    'org/project2',
+                    ref='refs/heads/master'))
+            self.waitUntilSettled()
+            cache_mock.assert_not_called()
+
     def _test_push_event_reconfigure(self, project, branch,
                                      expect_reconfigure=False,
                                      old_sha=None, new_sha=None,

zuul/connection/__init__.py

@@ -526,8 +526,15 @@ class ZKBranchCacheMixin:
                 project_name, required_flags, default=None)
 
             if branches is not None:
-                if ((branch_info := branches.get(event.branch)) is None or
-                        branch_info.protected != protected):
+                if (
+                    # We have information about that branch and the
+                    # protected state changed ...
+                    ((branch_info := branches.get(event.branch))
+                        and branch_info.protected != protected)
+                    # ... OR we don't have any branch info, but the
+                    # branch is now protected
+                    or (branch_info is None and protected)
+                ):
                     log = get_annotated_logger(self.log, event)
                     log.info("Project %s branch %s protected state "
                              "changed to %s",