Add include/exclude repo filters to team settings schema (backport #1009) - #1038
Open
decyjphr wants to merge 4 commits into
Open
Add include/exclude repo filters to team settings schema (backport #1009)#1038decyjphr wants to merge 4 commits into
decyjphr wants to merge 4 commits into
Conversation
Backport of PR #1009 (github-community-projects/safe-settings) onto the yadhav/fix-recent-issues line. Team entries are filtered by the same Diffable include/exclude logic that collaborators use, but the team schema never declared these keys, so editors and linters couldn't validate them. Mirror the collaborators allOf pattern to declare include/exclude on the teams items, rebuild the dereferenced schema, document both in the teams guide, add a sample, and cover the filter path with unit tests. No runtime changes -- filtering already works via Diffable.filterEntries. Adapted to this branch: schemas are consolidated in schema/settings.json (no separate repos/suborgs schema files), teams is defined inline, and team tests mock github.teams/github.repos (not github.rest.*). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5dac2ffd-8dc2-45b4-89c9-789f103d2be8
Exercises the backported team include/exclude schema end-to-end: creates a repo via a repo-level config whose team entries carry include/exclude globs and asserts safe-settings applies only the team whose include glob matches the repo (and skips the excluded / non-matching teams). Self-contained so it runs alone via `--phase 18`; teardown cleans up the repo and teams. Verified live against org decyjphr-emu: 7/7 assertions passed. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5dac2ffd-8dc2-45b4-89c9-789f103d2be8
decyjphr
changed the base branch from
main-enterprise
to
yadhav/fix-recent-issues
July 27, 2026 21:49
Contributor
There was a problem hiding this comment.
Pull request overview
This PR backports upstream work to declare include/exclude repo filters for teams entries in the settings schema, and documents/tests the behavior that already exists at runtime via Diffable.filterEntries.
Changes:
- Extend
teamsschema to allowinclude/excludearrays (mirroring the collaboratorsallOfpattern) and regenerate the dereferenced schema. - Add documentation and a sample config demonstrating team include/exclude filtering.
- Add unit tests and a new smoke-test phase to exercise include/exclude behavior end-to-end.
Show a summary per file
| File | Description |
|---|---|
schema/settings.json |
Adds include/exclude properties under teams.items via allOf. |
schema/dereferenced/settings.json |
Regenerated dereferenced schema capturing the new teams shape plus previously uncommitted drift. |
docs/github-settings/4. teams.md |
Documents teams[].include / teams[].exclude semantics with examples. |
docs/sample-settings/settings.yml |
Adds sample team entries using include and exclude. |
test/unit/lib/plugins/teams.test.js |
Adds unit tests asserting filtering prevents/permits team application based on globs. |
smoke-test.js |
Adds Phase 18 smoke test to validate include/exclude behavior against a live org. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comments suppressed due to low confidence (1)
schema/settings.json:157
- The
includedescription is misleading/unclear and doesn't mention that values are glob patterns matched against the repo name. The docs describe this correctly, andDiffable.filterEntries()uses minimatch globs.
"include": {
"description": "You can include a list of repos for this team and only those repos would have this team",
"type": "array",
"items": {
"type": "string"
- Files reviewed: 6/6 changed files
- Comments generated: 2
- Review effort level: Low
Comment on lines
+139
to
+143
| "allOf": [ | ||
| { | ||
| "$ref": "https://raw.githubusercontent.com/github/rest-api-description/main/descriptions/api.github.com/api.github.com.2022-11-28.json#/paths/~1orgs~1{org}~1teams/post/requestBody/content/application~1json/schema" | ||
| }, | ||
| { |
The teams settings schema referenced the "Create a team" POST requestBody, whose `permission` enum is limited to pull/push. safe-settings actually grants repo access via the "Add or update team repository permissions" PUT endpoint, which supports triage/maintain/admin and custom repository roles. As a result, valid team entries (e.g. `permission: maintain`, matching the docs examples) were incorrectly rejected by schema validation. Switch teams.items to reference the team-repo-permissions PUT schema (where `permission` is an unconstrained string) and declare the plugin's supported keys locally: name (required), privacy, external_group, include, exclude. Also strengthen smoke Phase 18 to grant the included team `maintain` permission, proving a value the old schema rejected now validates and applies. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5dac2ffd-8dc2-45b4-89c9-789f103d2be8
The previous descriptions were vague and did not mention that values are glob patterns matched against the repository name (as documented and as implemented by Diffable.filterEntries() via minimatch). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5dac2ffd-8dc2-45b4-89c9-789f103d2be8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Backports PR #1009 onto the
yadhav/fix-recent-issuesline: addsinclude/excluderepo filters to the team settings schema, plus docs, a sample, and unit tests. No runtime changes — team entries are already filtered by the sharedDiffable.filterEntriesinclude/exclude logic (the same one collaborators use); the team schema simply never declared these keys, so editors and linters couldn't validate them.Solves the same gap as upstream #1011 / #1009, for teams.
Why it's needed on this branch
include/excludeinschema/settings.json; teams did not.include/excludeviaDiffable.filterEntries, so configs using them work but fail schema validation in editors/linters.What changed
schema/settings.json—teams.itemsnow mirrors thecollaboratorsallOfpattern to declareinclude/excludearrays.schema/dereferenced/settings.json— regenerated vianpm run build:schema. (This also picked up pre-existing drift —app_installations— because the committed dereferenced file was stale relative to its source.)docs/github-settings/4. teams.md— documentsincludeandexcludewith examples.docs/sample-settings/settings.yml— adds sample teams usinginclude/exclude.test/unit/lib/plugins/teams.test.js— 3 tests covering the filter path (adapted to this branch'sgithub.teams.*mocks andtoParamsshape).smoke-test.js— new self-contained Phase 18 that exercises the feature end-to-end (--phase 18).Adapted to this branch's layout
Unlike upstream, this branch consolidates schemas into a single
schema/settings.json(no separaterepos.json/suborgs.json), definesteamsinline, and its team tests mockgithub.teams/github.repos(notgithub.rest.*) withtoParamsincludingteam_id. The backport was reworked accordingly rather than cherry-picked.Validation
teamssub-schema now accepts validinclude/excludearrays and rejects bad types; confirmed the pre-backport schema did not declare them.decyjphr-emu):node smoke-test.js --phase 18→ 7/7 passed — theinclude-matching team is applied; theexclude-matching and non-matching teams are correctly skipped.Co-authored-by: Copilot App 223556219+Copilot@users.noreply.github.com