feat(teams): document and test exclude/include repo filtering for tea…#1007
Closed
ipowellBT wants to merge 1 commit into
Closed
feat(teams): document and test exclude/include repo filtering for tea…#1007ipowellBT wants to merge 1 commit into
ipowellBT wants to merge 1 commit into
Conversation
…m entries `exclude` and `include` glob filters already work for teams at runtime via `Diffable.filterEntries()` but were undocumented in all three schemas and untested. This promotes the feature to officially supported: updates TeamSettings in settings.json, suborgs.json, and repos.json to use the same allOf + exclude/ include pattern as CollaboratorSettings, adds 10 unit tests covering exact match, glob wildcards, API property stripping, and grant revocation, and adds usage examples to the sample settings files. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR promotes existing exclude/include filtering for team entries (implemented via Diffable.filterEntries()) to an officially documented and tested feature across safe-settings configuration and schemas.
Changes:
- Added unit tests covering team
exclude/includebehavior (exact match, glob wildcards, API property stripping, and revocation semantics). - Updated org/suborg/repo JSON schemas to document
exclude/includeforTeamSettings. - Updated sample settings YAML to show practical usage patterns for
exclude/includeon teams.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 11 comments.
Show a summary per file
| File | Description |
|---|---|
| test/unit/lib/plugins/teams.test.js | Adds test coverage for exclude/include filtering and revocation behavior in the Teams plugin. |
| schema/settings.json | Documents exclude/include on team entries at org scope via allOf. |
| schema/suborgs.json | Documents exclude/include on team entries at suborg scope via allOf. |
| schema/repos.json | Documents exclude/include on team entries at repo override scope via allOf. |
| schema/dereferenced/settings.json | Updates dereferenced schema output to reflect new team schema composition and upstream schema changes. |
| schema/dereferenced/suborgs.json | Updates dereferenced schema output (includes additional upstream-generated changes). |
| schema/dereferenced/repos.json | Updates dereferenced schema output (includes additional upstream-generated changes). |
| docs/sample-settings/settings.yml | Adds examples demonstrating exclude/include usage for teams in org-level config. |
| docs/sample-settings/suborg.yml | Adds examples demonstrating exclude/include usage for teams in suborg config. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "type": "object", | ||
| "properties": { | ||
| "exclude": { | ||
| "description": "Glob patterns (minimatch) of repository names to exclude from this team grant. The team is applied to every repository in scope *except* those whose names match at least one of these patterns. If a repository is already a member of the team and later matches an exclude pattern, safe-settings will revoke that team membership.", |
| ] | ||
| }, | ||
| "include": { | ||
| "description": "Glob patterns (minimatch) of repository names to include for this team grant. When set, the team is applied *only* to repositories whose names match at least one of these patterns. Repositories not matching will have the team membership revoked if it was previously granted.", |
| "TeamSettings": { | ||
| "description": "A team entry", | ||
| "$ref": "https://raw.githubusercontent.com/github/rest-api-description/main/descriptions/api.github.com/api.github.com.2026-03-10.json#/paths/~1orgs~1{org}~1teams/post/requestBody/content/application~1json/schema" | ||
| "description": "A team entry. Use `exclude` and `include` to scope which repositories this team grant applies to within a suborg or org-level settings file. Patterns are evaluated using minimatch glob syntax against the repository name. Omit both properties to apply the team to every repository in scope.", |
| "type": "object", | ||
| "properties": { | ||
| "exclude": { | ||
| "description": "Glob patterns (minimatch) of repository names to exclude from this team grant. The team is applied to every repository in scope *except* those whose names match at least one of these patterns. If a repository is already a member of the team and later matches an exclude pattern, safe-settings will revoke that team membership.", |
| ] | ||
| }, | ||
| "include": { | ||
| "description": "Glob patterns (minimatch) of repository names to include for this team grant. When set, the team is applied *only* to repositories whose names match at least one of these patterns. Repositories not matching will have the team membership revoked if it was previously granted.", |
| ] | ||
| }, | ||
| "include": { | ||
| "description": "Glob patterns (minimatch) of repository names to include for this team grant. When set, the team is applied *only* to repositories whose names match at least one of these patterns. Repositories not matching will have the team membership revoked if it was previously granted.", |
| # every repository in scope *except* those matching the exclude glob patterns. | ||
| # Patterns use minimatch syntax (same engine as .gitignore-style globs). | ||
| # If a repo already has this team and later matches an exclude pattern, | ||
| # safe-settings will revoke the team membership on the next sync. |
| - test-* | ||
| # You can include only specific repositories for a team grant. The team is applied | ||
| # *only* to repositories whose names match at least one include glob pattern. | ||
| # Repositories not matching will have this team membership revoked if previously granted. |
Comment on lines
+180
to
+191
| "has_pull_requests": { | ||
| "type": "boolean", | ||
| "description": "Either `true` to allow pull requests for this repository or `false` to prevent pull requests.", | ||
| "default": true | ||
| }, | ||
| "pull_request_creation_policy": { | ||
| "type": "string", | ||
| "description": "The policy that controls who can create pull requests for this repository: `all` or `collaborators_only`.", | ||
| "enum": [ | ||
| "all", | ||
| "collaborators_only" | ||
| ] |
Comment on lines
+418
to
465
| "type": "object", | ||
| "properties": { | ||
| "name": { | ||
| "type": "string", | ||
| "description": "The name of the team." | ||
| }, | ||
| "description": { | ||
| "type": "string", | ||
| "description": "The description of the team." | ||
| }, | ||
| "maintainers": { | ||
| "type": "array", | ||
| "description": "List GitHub usernames for organization members who will become team maintainers.", | ||
| "items": { | ||
| "type": "string" | ||
| } | ||
| }, | ||
| "repo_names": { | ||
| "type": "array", | ||
| "description": "The full name (e.g., \"organization-name/repository-name\") of repositories to add the team to.", | ||
| "items": { | ||
| "type": "string" | ||
| } | ||
| }, | ||
| "privacy": { | ||
| "type": "string", | ||
| "description": "The level of privacy this team should have. The options are: \n**For a non-nested team:** \n * `secret` - only visible to organization owners and members of this team. \n * `closed` - visible to all members of this organization. \nDefault: `secret` \n**For a parent or child team:** \n * `closed` - visible to all members of this organization. \nDefault for child team: `closed`", | ||
| "enum": [ | ||
| "secret", | ||
| "closed" | ||
| ] | ||
| }, | ||
| "notification_setting": { | ||
| "type": "string", | ||
| "description": "The notification setting the team has chosen. The options are: \n * `notifications_enabled` - team members receive notifications when the team is @mentioned. \n * `notifications_disabled` - no one receives notifications. \nDefault: `notifications_enabled`", | ||
| "enum": [ | ||
| "notifications_enabled", | ||
| "notifications_disabled" | ||
| ] | ||
| }, | ||
| "parent_team_id": { | ||
| "type": "integer", | ||
| "description": "The ID of a team to set as the parent team." | ||
| } | ||
| }, | ||
| "required": [ | ||
| "name" | ||
| ] |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
…m entries
excludeandincludeglob filters already work for teams at runtime viaDiffable.filterEntries()but were undocumented in all three schemas and untested. This promotes the feature to officially supported: updates TeamSettings in settings.json, suborgs.json, and repos.json to use the same allOf + exclude/ include pattern as CollaboratorSettings, adds 10 unit tests covering exact match, glob wildcards, API property stripping, and grant revocation, and adds usage examples to the sample settings files.