Fix branch matching based on base name

pkg/matcher/annotation_matcher.go

@@ -28,8 +28,16 @@ const (
 func branchMatch(prunBranch, baseBranch string) bool {
 	// If we have targetBranch in annotation and refs/heads/targetBranch from
 	// webhook, then allow it.
+	// Also match for other variables which may exist between refs/heads and targetBranch
+	// ex: refs/heads/abc/xyz/targetBranch
+	// In those cases branch matching should fail
 	if filepath.Base(baseBranch) == filepath.Base(prunBranch) {
-		return true
+		if strings.HasPrefix(baseBranch, "refs/heads") {
+			baseBranchValues := strings.Split(baseBranch, "refs/heads")
+			if baseBranchValues[1] == prunBranch {
+				return true
+			}
+		}
 	}
 
 	// if target is refs/heads/.. and base is without ref (for pullRequest)

pkg/matcher/annotation_matcher_test.go

@@ -813,6 +813,16 @@ func TestMatchPipelinerunByAnnotation(t *testing.T) {
 		},
 	}
 
+	pipelinePush := &tektonv1.PipelineRun{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "pipeline-push",
+			Annotations: map[string]string{
+				keys.OnEvent:        "[push]",
+				keys.OnTargetBranch: "[main]",
+			},
+		},
+	}
+
 	pipelineOther := &tektonv1.PipelineRun{
 		ObjectMeta: metav1.ObjectMeta{
 			Name: "pipeline-other",
@@ -1050,6 +1060,22 @@ func TestMatchPipelinerunByAnnotation(t *testing.T) {
 			},
 			wantErr: false,
 		},
+		{
+			name: "not-match-push-branch-matching",
+			args: args{
+				runevent: info.Event{TriggerTarget: "push", EventType: "push", BaseBranch: "refs/heads/someothername/then/main"},
+				pruns:    []*tektonv1.PipelineRun{pipelineGood, pipelinePush},
+			},
+			wantErr: true,
+		},
+		{
+			name: "not-match-pull-request-branch-matching",
+			args: args{
+				runevent: info.Event{TriggerTarget: "pull_request", EventType: "pull_request", BaseBranch: "someothername/then/main"},
+				pruns:    []*tektonv1.PipelineRun{pipelineGood, pipelinePush},
+			},
+			wantErr: true,
+		},
 	}
 
 	for _, tt := range tests {