Skip to content

Add include/exclude repo filters to team settings schema (backport #1009) - #1038

Open
decyjphr wants to merge 4 commits into
yadhav/fix-recent-issuesfrom
yadhav/fix-recent-issues-team-include-exclude
Open

Add include/exclude repo filters to team settings schema (backport #1009)#1038
decyjphr wants to merge 4 commits into
yadhav/fix-recent-issuesfrom
yadhav/fix-recent-issues-team-include-exclude

Conversation

@decyjphr

Copy link
Copy Markdown
Collaborator

Summary

Backports PR #1009 onto the yadhav/fix-recent-issues line: adds include/exclude repo filters to the team settings schema, plus docs, a sample, and unit tests. No runtime changes — team entries are already filtered by the shared Diffable.filterEntries include/exclude logic (the same one collaborators use); the team schema simply never declared these keys, so editors and linters couldn't validate them.

Solves the same gap as upstream #1011 / #1009, for teams.

Why it's needed on this branch

  • Collaborators already declare include/exclude in schema/settings.json; teams did not.
  • The runtime already filters teams by include/exclude via Diffable.filterEntries, so configs using them work but fail schema validation in editors/linters.

What changed

  • schema/settings.jsonteams.items now mirrors the collaborators allOf pattern to declare include/exclude arrays.
  • schema/dereferenced/settings.json — regenerated via npm run build:schema. (This also picked up pre-existing drift — app_installations — because the committed dereferenced file was stale relative to its source.)
  • docs/github-settings/4. teams.md — documents include and exclude with examples.
  • docs/sample-settings/settings.yml — adds sample teams using include/exclude.
  • test/unit/lib/plugins/teams.test.js — 3 tests covering the filter path (adapted to this branch's github.teams.* mocks and toParams shape).
  • smoke-test.js — new self-contained Phase 18 that exercises the feature end-to-end (--phase 18).

Adapted to this branch's layout

Unlike upstream, this branch consolidates schemas into a single schema/settings.json (no separate repos.json/suborgs.json), defines teams inline, and its team tests mock github.teams/github.repos (not github.rest.*) with toParams including team_id. The backport was reworked accordingly rather than cherry-picked.

Validation

  • Unit tests: full suite 314 passed (3 new team filtering tests).
  • Schema (AJV): the teams sub-schema now accepts valid include/exclude arrays and rejects bad types; confirmed the pre-backport schema did not declare them.
  • Smoke test (live, org decyjphr-emu): node smoke-test.js --phase 187/7 passed — the include-matching team is applied; the exclude-matching and non-matching teams are correctly skipped.

Co-authored-by: Copilot App 223556219+Copilot@users.noreply.github.com

decyjphr and others added 2 commits July 27, 2026 17:39
Backport of PR #1009 (github-community-projects/safe-settings) onto the
yadhav/fix-recent-issues line.

Team entries are filtered by the same Diffable include/exclude logic that
collaborators use, but the team schema never declared these keys, so editors
and linters couldn't validate them. Mirror the collaborators allOf pattern to
declare include/exclude on the teams items, rebuild the dereferenced schema,
document both in the teams guide, add a sample, and cover the filter path with
unit tests. No runtime changes -- filtering already works via
Diffable.filterEntries.

Adapted to this branch: schemas are consolidated in schema/settings.json (no
separate repos/suborgs schema files), teams is defined inline, and team tests
mock github.teams/github.repos (not github.rest.*).

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 5dac2ffd-8dc2-45b4-89c9-789f103d2be8
Exercises the backported team include/exclude schema end-to-end: creates a
repo via a repo-level config whose team entries carry include/exclude globs and
asserts safe-settings applies only the team whose include glob matches the repo
(and skips the excluded / non-matching teams). Self-contained so it runs alone
via `--phase 18`; teardown cleans up the repo and teams.

Verified live against org decyjphr-emu: 7/7 assertions passed.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 5dac2ffd-8dc2-45b4-89c9-789f103d2be8
Copilot AI review requested due to automatic review settings July 27, 2026 21:48
@decyjphr
decyjphr changed the base branch from main-enterprise to yadhav/fix-recent-issues July 27, 2026 21:49

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR backports upstream work to declare include/exclude repo filters for teams entries in the settings schema, and documents/tests the behavior that already exists at runtime via Diffable.filterEntries.

Changes:

  • Extend teams schema to allow include/exclude arrays (mirroring the collaborators allOf pattern) and regenerate the dereferenced schema.
  • Add documentation and a sample config demonstrating team include/exclude filtering.
  • Add unit tests and a new smoke-test phase to exercise include/exclude behavior end-to-end.
Show a summary per file
File Description
schema/settings.json Adds include/exclude properties under teams.items via allOf.
schema/dereferenced/settings.json Regenerated dereferenced schema capturing the new teams shape plus previously uncommitted drift.
docs/github-settings/4. teams.md Documents teams[].include / teams[].exclude semantics with examples.
docs/sample-settings/settings.yml Adds sample team entries using include and exclude.
test/unit/lib/plugins/teams.test.js Adds unit tests asserting filtering prevents/permits team application based on globs.
smoke-test.js Adds Phase 18 smoke test to validate include/exclude behavior against a live org.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comments suppressed due to low confidence (1)

schema/settings.json:157

  • The include description is misleading/unclear and doesn't mention that values are glob patterns matched against the repo name. The docs describe this correctly, and Diffable.filterEntries() uses minimatch globs.
              "include": {
                "description": "You can include a list of repos for this team and only those repos would have this team",
                "type": "array",
                "items": {
                  "type": "string"
  • Files reviewed: 6/6 changed files
  • Comments generated: 2
  • Review effort level: Low

Comment thread schema/settings.json
Comment on lines +139 to +143
"allOf": [
{
"$ref": "https://raw.githubusercontent.com/github/rest-api-description/main/descriptions/api.github.com/api.github.com.2022-11-28.json#/paths/~1orgs~1{org}~1teams/post/requestBody/content/application~1json/schema"
},
{
Comment thread schema/settings.json
decyjphr and others added 2 commits July 27, 2026 18:03
The teams settings schema referenced the "Create a team" POST requestBody,
whose `permission` enum is limited to pull/push. safe-settings actually
grants repo access via the "Add or update team repository permissions" PUT
endpoint, which supports triage/maintain/admin and custom repository roles.
As a result, valid team entries (e.g. `permission: maintain`, matching the
docs examples) were incorrectly rejected by schema validation.

Switch teams.items to reference the team-repo-permissions PUT schema (where
`permission` is an unconstrained string) and declare the plugin's supported
keys locally: name (required), privacy, external_group, include, exclude.

Also strengthen smoke Phase 18 to grant the included team `maintain`
permission, proving a value the old schema rejected now validates and applies.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 5dac2ffd-8dc2-45b4-89c9-789f103d2be8
The previous descriptions were vague and did not mention that values are
glob patterns matched against the repository name (as documented and as
implemented by Diffable.filterEntries() via minimatch).

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 5dac2ffd-8dc2-45b4-89c9-789f103d2be8
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants