GHA-163 Add Lock Branch Action to manage branch protection settings

[nils-werner-sonarsource]

This pull request introduces a new reusable GitHub Action called "Lock Branch" that enables locking or unlocking a branch by modifying the lock_branch setting in branch protection rules. The implementation includes the action logic, Slack notification integration, documentation, and automated testing workflow.

Key additions and changes:

Lock Branch Action Implementation:

• Added a new composite GitHub Action in lock-branch/ that can lock or unlock a branch via the GitHub API, preserving existing branch protection settings. The action supports Slack notifications and secure token handling via Vault. [1] [2] [3] [4]

Documentation:

• Added lock-branch/README.md with detailed usage instructions, prerequisites, behavior, and error handling for the new action.
• Updated the main README.md to document the new "Lock Branch" action and its workflow.

CI/CD and Testing:

• Introduced a new workflow .github/workflows/test-lock-branch.yml to run unit tests for the lock-branch action, and registered it in the main test workflow. [1] [2]
• Manual test done in sonar-php https://github.com/SonarSource/sonar-php/actions/workflows/lock-branch-test.yml

[hashicorp-vault-sonar-prod]

GHA-163

[yasen-pavlov-sonarsource]

LGTM! 🚀 Left one small comment regarding the payload for the PUT request

[sonarqubecloud]

SonarQube reviewer guide

Summary: Adds a new "Lock Branch" GitHub Action that enables locking/unlocking branches by modifying branch protection rules, with complete implementation, tests, and CI workflow integration.

Review Focus:

• The build_protection_payload() function in lock_branch.py is critical—verify it correctly handles all branch protection settings preservation, especially the conversion of API response format (nested objects with enabled keys) to request format (flat booleans).
• Validate the GitHub API calls use correct headers and handle edge cases (no existing protection, various 2xx status codes).
• Ensure test coverage for lock_branch.py is comprehensive, particularly around payload construction with mixed existing settings.

Start review at: lock-branch/lock_branch.py. This is the core logic that interacts with GitHub's API to modify branch protection. The payload building logic is complex due to the need to preserve existing settings while updating only the lock state, making it the highest risk area for bugs.

💬 Please send your feedback

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud