chore: add branch protection to release branches, update release_process.md (apache#4665)

Author: mbutrovich

.asf.yaml

@@ -46,6 +46,57 @@ github:
     main:
       required_pull_request_reviews:
         required_approving_review_count: 1
+    branch-0.1:
+      required_pull_request_reviews:
+        required_approving_review_count: 1
+    branch-0.2:
+      required_pull_request_reviews:
+        required_approving_review_count: 1
+    branch-0.3:
+      required_pull_request_reviews:
+        required_approving_review_count: 1
+    branch-0.4:
+      required_pull_request_reviews:
+        required_approving_review_count: 1
+    branch-0.5:
+      required_pull_request_reviews:
+        required_approving_review_count: 1
+    branch-0.6:
+      required_pull_request_reviews:
+        required_approving_review_count: 1
+    branch-0.7:
+      required_pull_request_reviews:
+        required_approving_review_count: 1
+    branch-0.8:
+      required_pull_request_reviews:
+        required_approving_review_count: 1
+    branch-0.9:
+      required_pull_request_reviews:
+        required_approving_review_count: 1
+    branch-0.10:
+      required_pull_request_reviews:
+        required_approving_review_count: 1
+    branch-0.11:
+      required_pull_request_reviews:
+        required_approving_review_count: 1
+    branch-0.12:
+      required_pull_request_reviews:
+        required_approving_review_count: 1
+    branch-0.13:
+      required_pull_request_reviews:
+        required_approving_review_count: 1
+    branch-0.14:
+      required_pull_request_reviews:
+        required_approving_review_count: 1
+    branch-0.15:
+      required_pull_request_reviews:
+        required_approving_review_count: 1
+    branch-0.16:
+      required_pull_request_reviews:
+        required_approving_review_count: 1
+    branch-0.17:
+      required_pull_request_reviews:
+        required_approving_review_count: 1
   pull_requests:
     allow_update_branch: true
 # publishes the content of the `asf-site` branch to

docs/source/contributor-guide/release_process.md

@@ -30,6 +30,7 @@ instructions on each step.
 
 - [ ] Release preparation: review expression support status and user guide
 - [ ] Create release branch
+- [ ] Protect the release branch in `.asf.yaml`
 - [ ] Generate release documentation
 - [ ] Update Maven version in release branch
 - [ ] Update version in main for next development cycle
@@ -103,23 +104,45 @@ git checkout -b branch-0.13
 git push apache branch-0.13
 ```
 
+Creating the branch is the only direct push to it. After protecting the branch (next step), all later changes
+to the release branch (documentation, version bump, changelog) go through pull requests targeting it.
+
+### Protect the Release Branch
+
+Add the new branch to `protected_branches` in `.asf.yaml` so it requires a pull request and review, the same as
+`main`. ASF applies `.asf.yaml` from the default branch, so this is a PR against `main`:
+
+```yaml
+protected_branches:
+  main:
+    required_pull_request_reviews:
+      required_approving_review_count: 1
+  branch-0.13:
+    required_pull_request_reviews:
+      required_approving_review_count: 1
+```
+
+All release branches stay protected, including older ones, so released code cannot be pushed to directly.
+
 ### Generate Release Documentation
 
-Generate the documentation content for this release. The docs on `main` contain only template markers,
-so we need to generate the actual content (config tables, compatibility matrices) for the release branch:
+The docs on `main` contain only template markers; CI fills them at publish time. A release branch instead
+commits the generated content so the archived docs for the release render real tables. Run the script to
+generate the config reference and the per-Spark-version compatibility pages and freeze them onto the branch:
 
 ```shell
 ./dev/generate-release-docs.sh
 git add docs/source/user-guide/latest/
 git commit -m "Generate docs for 0.13.0 release"
-git push apache branch-0.13
 ```
 
-This freezes the documentation to reflect the configs and expressions available in this release.
+The script runs one Maven build per supported Spark version, so it takes a while. Open a PR with this commit
+targeting the release branch.
 
 ### Update Maven Version
 
-Update the `pom.xml` files in the release branch to update the Maven version from `0.13.0-SNAPSHOT` to `0.13.0`.
+Open a PR targeting the release branch that changes the Maven version from `0.13.0-SNAPSHOT` to `0.13.0` in
+the `pom.xml` files and in the diff files under `dev/diffs`.
 
 There is no need to update the Rust crate versions because they will already be `0.13.0`.