docs(ast-orchestrator): document the AST branch pattern across the four ALMs

[italovs]

What

The merge gate that dispatches the AST orchestrator used to compare the merged PR's base branch to a single name, with exact equality. Only two setups were expressible: one branch, or every branch. It is now a regular expression — the AST branch pattern — resolved at two levels.

The "Merge target branch" section had no way to describe that, so it is replaced by an "AST branch pattern" section in all four ALM orchestrator guides: GitHub, GitLab, Bitbucket and Azure DevOps.

What each guide now documents

• Where the pattern is set — repository-level (Branch pattern column on the repository table) and integration-level (Branch pattern that runs the AST).
• Resolution order — repository → integration → orchestrator Ref (legacy fallback) → every branch.
• Matching semantics — the whole branch name must match, so main does not match maintenance; | lists branches; a plain branch name behaves exactly as before.
• Validation — a pattern that does not compile, exceeds 500 characters, or is too slow is refused at save time, with the reason under the field.
• Fail-closed behaviour — a stored pattern that errors or times out while a merge is evaluated skips the scan instead of dispatching it.
• Worked examples — main, main|develop, release/.*, main|release/.*.
• Run AST on demand — the new Branch to scan picker, listing only branches matching the asset's pattern.

Anchoring and fail-closed are stated explicitly because both are observable behaviour, not implementation detail.

Ref keeps its own entry plus a note saying it is the orchestrator's branch — where ast.yml lives — and not a branch policy. It remains the filter only when nothing else is set.

Migration

None. Every value already stored keeps its exact meaning, and the guides say so plainly.

Also updated

Configuration step, validation checklist, troubleshooting table and frontmatter (description + keywords) of each of the four guides, and the AST row of the GitLab repositories validation table.

Related

• Backend: convisoappsec/platform-backend#14364
• Frontend: convisoappsec/platform-frontend#3094

🤖 Generated with Claude Code

[conviso-platform-appsec]

Conviso Security Gate — No Security Gate rule configured

No conviso_ast rule and no default rule are configured for this asset or company, so there is no policy to evaluate. Nothing was passed or failed.

No new findings were introduced by this pull request.

View the full run in Conviso