fix(pkg/filematcher): escape regex special characters in pattern matcher

[Norway-02]

What this PR does:
Fixes an issue in pkg/filematcher where regular expression metacharacters (+, (, ), {, }, |, ^) outside character classes [...] were not escaped when building internal regular expressions. As a result, file paths containing these characters (such as a+b.txt, foo(1).txt, foo{1}.txt, foo|bar.txt, or ^foo.txt) failed to match their corresponding patterns.

Why we need it:
Without escaping regex metacharacters outside [...], pattern matching fails on standard file paths and names containing parentheses, plus signs, braces, pipes, or carets.

Which issue(s) this PR fixes:
Fixes # NONE

Does this PR introduce a user-facing change?:

• How are users affected by this change: None
• Is this breaking change: No
• How to migrate (if breaking change): N/A

Screenshots/Videos (for documentation or website changes):
N/A

[netlify]

✅ Deploy Preview for pipecd-site ready!

Name	Link
🔨 Latest commit	7042f2e
🔍 Latest deploy log	https://app.netlify.com/projects/pipecd-site/deploys/6aa24f978518670008ee6a6f
😎 Deploy Preview	https://deploy-preview-7360--pipecd-site.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[github-actions]

👋 Hi @Norway-02, welcome to PipeCD and thanks for opening your first pull request!

We’re really happy to have you here

Before your PR gets merged, please check a few important things below.

---

Helpful resources

• Contributing guide: https://github.com/pipe-cd/pipecd/blob/master/CONTRIBUTING.md
• Development setup: https://github.com/pipe-cd/pipecd/blob/master/CONTRIBUTING.md#development

---

DCO Sign-off

All commits must include a Signed-off-by line to comply with the Developer Certificate of Origin (DCO).

In case you forget to sign-off your commit(s), follow these steps:

For the last commit:

git commit --amend --signoff
git push --force-with-lease

For multiple commits:

git rebase --signoff origin/master
git push --force-with-lease

---

Run checks locally

Before pushing updates, please run:

make check

This runs the same checks as CI and helps catch issues early.

---

💬 Need help?

If anything is unclear, feel free to ask in this PR or join us on the CNCF Slack in the #pipecd channel.
You can get your Slack invite from: https://communityinviter.com/apps/cloud-native/cncf

Thanks for contributing to PipeCD! ❤️

[Copilot]

🟢 Approval recommended

The change is narrowly scoped, aligns with filepath.Match semantics, and includes targeted regression tests for the reported mismatch cases.

Pull request overview

This PR fixes pkg/filematcher’s pattern-to-regex conversion so that regex metacharacters that are not meaningful in filepath.Match (e.g., +(){}|^) are correctly escaped when they appear outside of character classes ([...]). This prevents legitimate file paths containing those characters from failing to match.

Changes:

• Track whether the scanner is inside a character class ([...]) while building the internal regexp.
• Escape additional regexp metacharacters outside of character classes while preserving glob semantics for */?.
• Add regression tests covering filenames that include +(){}|^.

File summaries

File	Description
pkg/filematcher/filematcher.go	Escapes additional regexp metacharacters outside [...] and treats */? literally inside character classes.
pkg/filematcher/filematcher_test.go	Adds regression cases for matching literal `+(){}

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Norway-02]

cc @mohammedfirdouss @TheRealShek @Warashi - Please review when you get a chance. Thanks!