fix(ci): use **/* excludes in branch-creation ruleset to unfreeze the merge queue

[Yicong-Huang]

What changes were proposed in this PR?

Fix the Restrict Branch Creation ruleset excludes so all allowlisted prefixes match at any depth: release/**/*, backport/**/*, dependabot/**/*, and gh-readonly-queue/**/* (previously gh-readonly-queue/*; main and gh-pages stay exact).

GitHub ruleset globs do not cross /, and — contrary to intuition — even a trailing ** still only matches a single segment. The merge queue's temp branches nest the base ref and are multi-segment (gh-readonly-queue/main/pr-N, gh-readonly-queue/release/v1.2/pr-N), so gh-readonly-queue/* (and **) never matched them; the creation rule blocked the queue from creating its temp branch, freezing merges to main and every release branch. **/* matches at any depth (and still matches single-segment refs), so the queue can form again. Dependabot branches are multi-segment too, hence dependabot/**/*.

Any related issues, documentation, discussions?

Regression from #7121, which activated the Restrict Branch Creation ruleset. Unblocks backport PRs such as #7101.

How was this PR tested?

Verified empirically against the live GitHub rulesets API on a fork: built the ruleset from this exact .asf.yaml and queried GET /rules/branches/.... creation is no longer active on gh-readonly-queue/main/pr-1, gh-readonly-queue/release/v1.2/pr-7101, release/v1.2, release/v1.1, backport/*, dependabot/npm/*, main, or gh-pages (all allowed); unrelated branches (feature/*) stay blocked. The earlier gh-readonly-queue/** was confirmed to still leave creation active on those multi-segment refs.

Was this PR authored or co-authored using generative AI tooling?

Generated-by: Claude Code (Claude Opus 4.8)

[github-actions]

Automated Reviewer Suggestions

Based on the git blame history of the changed files, we recommend the following reviewers:

• No candidates found from git blame history.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.56%. Comparing base (8c255b8) to head (a232afb).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@             Coverage Diff              @@
##               main    #7123      +/-   ##
============================================
- Coverage     79.56%   79.56%   -0.01%     
  Complexity     3834     3834              
============================================
  Files          1159     1159              
  Lines         46145    46145              
  Branches       5127     5127              
============================================
- Hits          36717    36716       -1     
- Misses         7798     7799       +1     
  Partials       1630     1630              

Flag	Coverage Δ
access-control-service	70.00% <ø> (ø)
agent-service	77.42% <ø> (ø)
amber	73.06% <ø> (-0.01%)	⬇️
computing-unit-managing-service	20.49% <ø> (ø)
config-service	66.66% <ø> (ø)
file-service	67.21% <ø> (ø)
frontend	83.05% <ø> (ø)
notebook-migration-service	78.94% <ø> (ø)
pyamber	97.36% <ø> (ø)
workflow-compiling-service	26.31% <ø> (ø)

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

⚠️ Benchmark changes need a look

🟢 2 better · 🔴 4 worse · ⚪ 9 noise (<±5%) · 0 without baseline

Compared against main 8c255b8 benchmarked on this same runner, so the delta is largely free of cross-runner hardware noise. The "7d avg" column still reflects the gh-pages dashboard. Treat <±5% as noise unless repeated.

Dashboard · Run

	config	throughput	MB/s	latency	max Δ latest / 7d
🔴	bs=10 sw=10 sl=64	348	0.213	27,057/40,042/40,042 us	🔴 +14.2% / 🔴 +153.8%
🟢	bs=100 sw=10 sl=64	794	0.485	125,383/138,656/138,656 us	🟢 -8.6% / 🔴 +29.2%
⚪	bs=1000 sw=10 sl=64	921	0.562	1,080,608/1,129,431/1,129,431 us	⚪ within ±5% / 🔴 -10.7%

Baseline details

Latest main 8c255b8 from same runner

config	metric	PR	latest main	7d avg	Δ latest	Δ 7d
bs=10 sw=10 sl=64	throughput	348 tuples/sec	371 tuples/sec	786.12 tuples/sec	-6.2%	-55.7%
bs=10 sw=10 sl=64	MB/s	0.213 MB/s	0.227 MB/s	0.48 MB/s	-6.2%	-55.6%
bs=10 sw=10 sl=64	p50	27,057 us	27,846 us	12,305 us	-2.8%	+119.9%
bs=10 sw=10 sl=64	p95	40,042 us	35,049 us	15,774 us	+14.2%	+153.8%
bs=10 sw=10 sl=64	p99	40,042 us	35,049 us	18,978 us	+14.2%	+111.0%
bs=100 sw=10 sl=64	throughput	794 tuples/sec	791 tuples/sec	999.71 tuples/sec	+0.4%	-20.6%
bs=100 sw=10 sl=64	MB/s	0.485 MB/s	0.483 MB/s	0.61 MB/s	+0.4%	-20.5%
bs=100 sw=10 sl=64	p50	125,383 us	121,809 us	100,616 us	+2.9%	+24.6%
bs=100 sw=10 sl=64	p95	138,656 us	151,632 us	107,356 us	-8.6%	+29.2%
bs=100 sw=10 sl=64	p99	138,656 us	151,632 us	113,255 us	-8.6%	+22.4%
bs=1000 sw=10 sl=64	throughput	921 tuples/sec	914 tuples/sec	1,031 tuples/sec	+0.8%	-10.7%
bs=1000 sw=10 sl=64	MB/s	0.562 MB/s	0.558 MB/s	0.63 MB/s	+0.7%	-10.7%
bs=1000 sw=10 sl=64	p50	1,080,608 us	1,097,543 us	980,328 us	-1.5%	+10.2%
bs=1000 sw=10 sl=64	p95	1,129,431 us	1,135,889 us	1,027,528 us	-0.6%	+9.9%
bs=1000 sw=10 sl=64	p99	1,129,431 us	1,135,889 us	1,054,298 us	-0.6%	+7.1%

Raw CSV

config_idx,batch_size,schema_width,string_len,num_batches,total_ms,total_tuples,total_bytes,tuples_per_sec,mb_per_sec,lat_p50_us,lat_p95_us,lat_p99_us
0,10,10,64,20,574.44,200,128000,348,0.213,27056.96,40042.36,40042.36
1,100,10,64,20,2518.87,2000,1280000,794,0.485,125383.10,138656.16,138656.16
2,1000,10,64,20,21711.42,20000,12800000,921,0.562,1080607.86,1129430.97,1129430.97