Precedence order not working as expected for arrays in branch policy

[riprasad]

Problem Description

As per the README - The precedence order for settings file is repository > suborg > org (.github/repos/.yml > .github/suborgs/.yml > .github/settings.yml

However, when defining branch policies at both the suborganization and repository levels, policies that require array inputs are merged rather than being overridden.

What is actually happening

suborg/default.bpr.yml

suborgrepos:
  - '*'
  
branches:
  - name: default
    protection:
        required_pull_request_reviews: null
        required_status_checks: null
        enforce_admins: false
        restrictions:
            apps: ['app-01', 'app-02']
            users: ['user-01']
            teams: []

repos/repo.yml

branches:
  - name: default
    protection:
        required_pull_request_reviews: null
        required_status_checks: null
        enforce_admins: true
        restrictions:
            apps: ['app-03']
            users: ['user-02']
            teams: []

Properties with boolean or string input types are functioning as expected, and the values defined in the repo.yml file are being correctly applied. However, properties with array input types are being merged instead of being overridden.

For instance, the restriction being applied is:

        restrictions:
            apps: ['app-01', 'app-02', 'app-03']
            users: ['user-01', 'user-02']
            teams: []

What is the expected behavior

Only the apps and users defined in the repo.yml should be applied, while the apps and users defined the sub-org level should be ignored.

        restrictions:
            apps: ['app-03']
            users: ['user-02']
            teams: []

Error output, if available

NA

Context

Are you using the hosted instance of probot/settings or running your own?

Running Safe Settings via Github Actions

If running your own instance, are you using it with github.com or GitHub Enterprise?

github.com

Version of probot/settings

2.1.14

Version of GitHub Enterprise

NA

[riprasad]

I'm observing the same behavior with rulesets as well when overriding the bypass_actors in the repository-level settings file.

Additionally, duplicate patterns are being created because the merged config has the same pattern twice

conditions: {
      "ref_name": {
        "include": [
          "refs/heads/rhoai-*",
          "refs/heads/rhoai-*"
        ],
        "exclude": []
      }

[riprasad]

I discovered that the issue stems from the way safe-settings creates the final merged config from the settings files. There's also an edge case where the API call fails due to duplicate elements in the merged config. I've filed another bug report with all the relevant details.

#723