From 81ac9451d8be4cf99f32d489dc4eb2bdb8d5e756 Mon Sep 17 00:00:00 2001
From: "James E. Blair" <jim@acmegating.com>
Date: Thu, 27 Feb 2025 10:09:20 -0800
Subject: [PATCH] Add test for locked branch filtering on validation

Change Ia4992e55d1f0448d98667cbfd71ba033c966918e fixed a bug with
performing tenant-validation on locked branches.  This adds a test
which exercises that code path.

The validation test in this change is effective.  The startup test
did not fail even without the bugfix (because the initial call to
fetch the branch list does not result in a cat job).

Change-Id: I2fbcf76df338fba80adf954ac066a6e63111f3b2
---
 tests/base.py                    |  3 +-
 tests/fakegithub.py              | 14 +++++++--
 tests/unit/test_github_driver.py | 52 ++++++++++++++++++++++++++++++++
 3 files changed, 66 insertions(+), 3 deletions(-)

diff --git a/tests/base.py b/tests/base.py
index 548c011402..ffdf321526 100644
--- a/tests/base.py
+++ b/tests/base.py
@@ -246,7 +246,7 @@ def driver_config(driver, **kw):
         if driver_dict is None:
             driver_dict = {}
             test.__driver_config__ = driver_dict
-        driver_dict[driver] == kw
+        driver_dict[driver] = kw
         return test
     return decorator
 
@@ -382,6 +382,7 @@ class GithubDriverMock(GithubDriver):
                  additional_event_queues, git_url_with_auth):
         super(GithubDriverMock, self).__init__()
         self.registry = registry
+        self.test_config = test_config
         self.changes = test_config.changes
         self.config = config
         self.upstream_root = upstream_root
diff --git a/tests/fakegithub.py b/tests/fakegithub.py
index 872e9213b8..0e39e2022a 100644
--- a/tests/fakegithub.py
+++ b/tests/fakegithub.py
@@ -1291,8 +1291,17 @@ class FakeGithubClient(object):
 
     def addProject(self, project):
         owner, proj = project.name.split('/')
-        self._data.repos[(owner, proj)] = FakeRepository(
+        repo = FakeRepository(
             project.name, self._data)
+        self._data.repos[(owner, proj)] = repo
+        github_config =\
+            self._data.fake_github_connection.driver.test_config.driver.github
+        if bprs := github_config.get('branch_protection_rules', {}
+                                     ).get(project.name, {}):
+            for branch, rule_configs in bprs.items():
+                for rule_config in rule_configs:
+                    repo._set_branch_protection(
+                        branch, protected=True, **rule_config)
 
     def addProjectByName(self, project_name):
         owner, proj = project_name.split('/')
@@ -1523,7 +1532,8 @@ class FakeGithubConnection(githubconnection.GithubConnection):
     client_manager_class = FakeGithubClientManager
 
     def __init__(self, driver, connection_name, connection_config,
-                 changes_db=None, upstream_root=None, git_url_with_auth=False):
+                 changes_db=None, upstream_root=None,
+                 git_url_with_auth=False):
         super(FakeGithubConnection, self).__init__(driver, connection_name,
                                                    connection_config)
         self.connection_name = connection_name
diff --git a/tests/unit/test_github_driver.py b/tests/unit/test_github_driver.py
index eded235da7..1a5d8fdb87 100644
--- a/tests/unit/test_github_driver.py
+++ b/tests/unit/test_github_driver.py
@@ -43,6 +43,7 @@ from tests.base import (
     BaseTestCase,
     ZuulGithubAppTestCase,
     ZuulTestCase,
+    driver_config,
     iterate_timeout,
     okay_tracebacks,
     simple_layout,
@@ -2072,6 +2073,57 @@ class TestGithubLockedBranches(ZuulTestCase):
         self.assertEqual(0, len(tpc2.parsed_branch_config.keys()))
         self.assertEqual(0, len(tpc3.parsed_branch_config.keys()))
 
+    @driver_config('github', branch_protection_rules={
+        'org/project2': {
+            'master': [
+                {'locked': True},
+            ]
+        }
+    })
+    def test_exclude_locked_branches_startup(self):
+        # Make sure that we exclude locked branches on startup as well
+        # (this exercises a different code path in the branch cache).
+        tenant = self.scheds.first.sched.abide.tenants\
+            .get('tenant-one')
+
+        project1 = list(tenant.untrusted_projects)[0]
+        project2 = list(tenant.untrusted_projects)[1]
+        project3 = list(tenant.untrusted_projects)[2]
+
+        tpc1 = tenant.project_configs[project1.canonical_name]
+        tpc2 = tenant.project_configs[project2.canonical_name]
+        tpc3 = tenant.project_configs[project3.canonical_name]
+
+        # project 1 should have parsed master
+        self.assertIn('master', tpc1.parsed_branch_config.keys())
+        # project 1 should not have a master branch because it's locked
+        self.assertEqual(0, len(tpc2.parsed_branch_config.keys()))
+        # project 3 should not because it excludes unprotected
+        self.assertEqual(0, len(tpc3.parsed_branch_config.keys()))
+
+
+class TestGithubLockedBranchesValidation(ZuulTestCase):
+    config_file = 'zuul-github-driver.conf'
+    tenant_config_file = 'config/locked-branches/main.yaml'
+    scheduler_count = 1
+    validate_tenants = ['tenant-one']
+
+    @driver_config('github', branch_protection_rules={
+        'org/project2': {
+            'master': [
+                {'locked': True},
+            ]
+        }
+    })
+    def test_exclude_locked_branches_validation(self):
+        self.assertEqual(2, len(self.merge_job_history['cat']))
+        projects = {
+            x.payload['project']
+            for x in self.merge_job_history['cat']
+        }
+        self.assertEqual({'org/common-config', 'org/project1'},
+                         projects)
+
 
 class TestGithubWebhook(ZuulTestCase):
     config_file = 'zuul-github-driver.conf'