chore: Add script to protect RC branches during the release

[comphead]

Which issue does this PR close?

• Closes chore: Modify prerelease process to protect automatically RC branch #17134

Rationale for this change

ASF Infra works in tricky way, to apply a protection for the new branch its needed to get:

• branch created in repo
• add rules to .asf.yaml in main
• tricky part ASF reapply policies ONLY if .asf.yaml changed in PR, means that "future" branches won't be covered until the file changed and pushed.

Adding a script to add automatically a block with new RC branch protection rules and updated documentation

What changes are included in this PR?

Are these changes tested?

Are there any user-facing changes?

[comphead]

Adding you folks as you directly involved into release process

[comphead]

Script is Clauded, but I tried to test out all scenarios:

• branch number should be set and be a positive integer
• branch should exist in DF repo before calling the script
• check branch block doesn't exist in .asf.yaml

[martin-g]

Have you considered using yq or similar command line YAML tool to insert the new item ?
The syntax would be something like:

yq -i ".github.protected_branches += [{\"${BRANCH_NAME}\": {\"required_pull_request_reviews\": {\"required_approving_review_count\": 1}}}]" ${ASF_YAML_FILE}

It requires installing a third-party tool but would avoid the AWK script below.

[comphead]

thats the reason, we have too much steps in release process, so I was trying to make it possible in pure bash. Another option is to use python, but still thinking pure bash would fit better

[comphead]

@alamb @xudong963 please take a look

[alamb]

I tested this locally with

./dev/release/add-branch-protection.sh 49

Which output

Successfully added branch protection for branch-49 to .asf.yaml

Added block:
    branch-49:
      required_pull_request_reviews:
        required_approving_review_count: 1

Please review the changes and commit them.

And seemingly added everything needed

(venv) andrewlamb@Andrews-MacBook-Pro-3:~/Software/datafusion$ git diff
diff --git a/.asf.yaml b/.asf.yaml
index 0588a300a5..1efcaea640 100644
--- a/.asf.yaml
+++ b/.asf.yaml
@@ -62,6 +62,9 @@ github:
     branch-51:
       required_pull_request_reviews:
         required_approving_review_count: 1
+    branch-49:
+      required_pull_request_reviews:
+        required_approving_review_count: 1
   pull_requests:
     # enable updating head branches of pull requests
     allow_update_branch: true
(venv) andrewlamb@Andrews-MacBook-Pro-3:~/Software/datafusion$

Thanks @comphead !

[comphead]

Thanks @alamb for the review!