Add test for locked branch filtering on validation

Change Ia4992e55d1f0448d98667cbfd71ba033c966918e fixed a bug with
performing tenant-validation on locked branches.  This adds a test
which exercises that code path.

The validation test in this change is effective.  The startup test
did not fail even without the bugfix (because the initial call to
fetch the branch list does not result in a cat job).

Change-Id: I2fbcf76df338fba80adf954ac066a6e63111f3b2

tests/base.py

@@ -246,7 +246,7 @@ def driver_config(driver, **kw):
         if driver_dict is None:
             driver_dict = {}
             test.__driver_config__ = driver_dict
-        driver_dict[driver] == kw
+        driver_dict[driver] = kw
         return test
     return decorator
 
@@ -382,6 +382,7 @@ class GithubDriverMock(GithubDriver):
                  additional_event_queues, git_url_with_auth):
         super(GithubDriverMock, self).__init__()
         self.registry = registry
+        self.test_config = test_config
         self.changes = test_config.changes
         self.config = config
         self.upstream_root = upstream_root

tests/fakegithub.py

@@ -1291,8 +1291,17 @@ class FakeGithubClient(object):
 
     def addProject(self, project):
         owner, proj = project.name.split('/')
-        self._data.repos[(owner, proj)] = FakeRepository(
+        repo = FakeRepository(
             project.name, self._data)
+        self._data.repos[(owner, proj)] = repo
+        github_config =\
+            self._data.fake_github_connection.driver.test_config.driver.github
+        if bprs := github_config.get('branch_protection_rules', {}
+                                     ).get(project.name, {}):
+            for branch, rule_configs in bprs.items():
+                for rule_config in rule_configs:
+                    repo._set_branch_protection(
+                        branch, protected=True, **rule_config)
 
     def addProjectByName(self, project_name):
         owner, proj = project_name.split('/')
@@ -1523,7 +1532,8 @@ class FakeGithubConnection(githubconnection.GithubConnection):
     client_manager_class = FakeGithubClientManager
 
     def __init__(self, driver, connection_name, connection_config,
-                 changes_db=None, upstream_root=None, git_url_with_auth=False):
+                 changes_db=None, upstream_root=None,
+                 git_url_with_auth=False):
         super(FakeGithubConnection, self).__init__(driver, connection_name,
                                                    connection_config)
         self.connection_name = connection_name

tests/unit/test_github_driver.py

@@ -43,6 +43,7 @@ from tests.base import (
     BaseTestCase,
     ZuulGithubAppTestCase,
     ZuulTestCase,
+    driver_config,
     iterate_timeout,
     okay_tracebacks,
     simple_layout,
@@ -2072,6 +2073,57 @@ class TestGithubLockedBranches(ZuulTestCase):
         self.assertEqual(0, len(tpc2.parsed_branch_config.keys()))
         self.assertEqual(0, len(tpc3.parsed_branch_config.keys()))
 
+    @driver_config('github', branch_protection_rules={
+        'org/project2': {
+            'master': [
+                {'locked': True},
+            ]
+        }
+    })
+    def test_exclude_locked_branches_startup(self):
+        # Make sure that we exclude locked branches on startup as well
+        # (this exercises a different code path in the branch cache).
+        tenant = self.scheds.first.sched.abide.tenants\
+            .get('tenant-one')
+
+        project1 = list(tenant.untrusted_projects)[0]
+        project2 = list(tenant.untrusted_projects)[1]
+        project3 = list(tenant.untrusted_projects)[2]
+
+        tpc1 = tenant.project_configs[project1.canonical_name]
+        tpc2 = tenant.project_configs[project2.canonical_name]
+        tpc3 = tenant.project_configs[project3.canonical_name]
+
+        # project 1 should have parsed master
+        self.assertIn('master', tpc1.parsed_branch_config.keys())
+        # project 1 should not have a master branch because it's locked
+        self.assertEqual(0, len(tpc2.parsed_branch_config.keys()))
+        # project 3 should not because it excludes unprotected
+        self.assertEqual(0, len(tpc3.parsed_branch_config.keys()))
+
+
+class TestGithubLockedBranchesValidation(ZuulTestCase):
+    config_file = 'zuul-github-driver.conf'
+    tenant_config_file = 'config/locked-branches/main.yaml'
+    scheduler_count = 1
+    validate_tenants = ['tenant-one']
+
+    @driver_config('github', branch_protection_rules={
+        'org/project2': {
+            'master': [
+                {'locked': True},
+            ]
+        }
+    })
+    def test_exclude_locked_branches_validation(self):
+        self.assertEqual(2, len(self.merge_job_history['cat']))
+        projects = {
+            x.payload['project']
+            for x in self.merge_job_history['cat']
+        }
+        self.assertEqual({'org/common-config', 'org/project1'},
+                         projects)
+
 
 class TestGithubWebhook(ZuulTestCase):
     config_file = 'zuul-github-driver.conf'