From 4708e0061e585daf13207b3125dcd12c837a28db Mon Sep 17 00:00:00 2001
From: Simon Westphahl <simon.westphahl@bmw.de>
Date: Tue, 7 Jul 2026 14:41:18 +0200
Subject: [PATCH] Don't update protected flag if unprotected

In I4cc3ab2fc795aa1fc49293de1a3feb28c969cc35 we changed the branch cache
update decision to not update the protected flag for missing projects.

However, we introduced a small regression in that we also update the
branch cache if the branch is unprotected and wasn't protected before.

When there is no branch information and the branch is not protected we
can simply skip the update.

Change-Id: Icbbd22bd4cac87b0a232407653b51a9abe075398
---
 tests/unit/test_github_driver.py | 37 ++++++++++++++++++++++++++++++++
 zuul/connection/__init__.py      | 11 ++++++++--
 2 files changed, 46 insertions(+), 2 deletions(-)

diff --git a/tests/unit/test_github_driver.py b/tests/unit/test_github_driver.py
index adf7ffa581..d20ffc523b 100644
--- a/tests/unit/test_github_driver.py
+++ b/tests/unit/test_github_driver.py
@@ -2069,6 +2069,43 @@ class TestGithubUnprotectedBranches(ZuulTestCase):
             self.waitUntilSettled()
             cache_mock.assert_not_called()
 
+    def test_push_event_unprotected_branch_cache_update(self):
+        # Test that we do not update the branch cache for events on
+        # unprotected branches when exclude-unprotected-branches is
+        # configured.
+        self.create_branch('org/project2', 'feature')
+        github = self.fake_github.getGithubClient()
+        repo = github.repo_from_project('org/project2')
+        repo._set_branch_protection('master', True)
+        repo._create_branch('feature')
+
+        with (mock.patch(
+                "zuul.zk.branch_cache_new.BranchCacheNew.setProtected")
+              as cache_mock):
+            self.fake_github.emitEvent(
+                self.fake_github.getPushEvent(
+                    'org/project2',
+                    ref='refs/heads/feature'))
+            self.waitUntilSettled()
+            cache_mock.assert_not_called()
+
+    def test_push_event_protected_branch_cache_update(self):
+        # Test that we do not update the branch cache for events on
+        # protected branches when the protected state did not change.
+        github = self.fake_github.getGithubClient()
+        repo = github.repo_from_project('org/project2')
+        repo._set_branch_protection('master', True)
+
+        with (mock.patch(
+                "zuul.zk.branch_cache_new.BranchCacheNew.setProtected")
+              as cache_mock):
+            self.fake_github.emitEvent(
+                self.fake_github.getPushEvent(
+                    'org/project2',
+                    ref='refs/heads/master'))
+            self.waitUntilSettled()
+            cache_mock.assert_not_called()
+
     def _test_push_event_reconfigure(self, project, branch,
                                      expect_reconfigure=False,
                                      old_sha=None, new_sha=None,
diff --git a/zuul/connection/__init__.py b/zuul/connection/__init__.py
index 5e28d46901..6d2904de0b 100644
--- a/zuul/connection/__init__.py
+++ b/zuul/connection/__init__.py
@@ -526,8 +526,15 @@ class ZKBranchCacheMixin:
                 project_name, required_flags, default=None)
 
             if branches is not None:
-                if ((branch_info := branches.get(event.branch)) is None or
-                        branch_info.protected != protected):
+                if (
+                    # We have information about that branch and the
+                    # protected state changed ...
+                    ((branch_info := branches.get(event.branch))
+                        and branch_info.protected != protected)
+                    # ... OR we don't have any branch info, but the
+                    # branch is now protected
+                    or (branch_info is None and protected)
+                ):
                     log = get_annotated_logger(self.log, event)
                     log.info("Project %s branch %s protected state "
                              "changed to %s",