fix: resolve safe-settings sync workflow failures

[marcusburghardt]

Summary

Fix three bugs causing all Safe Settings Sync workflow runs to fail with exit code 1.

Root cause analysis: Workflow run #4 logs

Bugs Fixed

1. restrictedRepos patterns use regex syntax but safe-settings uses glob/minimatch

deployment-settings.yml used regex-style patterns ("^complyctl$") but safe-settings
matches via minimatch (glob),
not regex. The ^ and $ anchors have no special meaning in minimatch, so none of the
patterns ever matched — an unscoped full sync would skip all managed repos.

Fix: Replace with plain names (complyctl, community, etc.) which minimatch handles
correctly for exact matching.

2. Scoped deployment-settings leaks unmanaged repos

The "Generate scoped deployment-settings" step built a restrictedRepos.exclude list from
peribolos.yaml. Repos not in peribolos (nunya, roadmap) were missing from the exclude
list, causing safe-settings to process repos it should not manage.

From the workflow logs:

Allowing nunya not in restrictedRepos.exclude [...]
Allowing roadmap not in restrictedRepos.exclude [...]

Fix: Replace with a restrictedRepos.include allowlist built directly from the repos
input, matching the approach used by the base deployment-settings.yml.

3. check_suite TypeError crashes full-sync mode (upstream bug)

safe-settings v2.1.18 crashes in full-sync mode with:

TypeError: Cannot read properties of undefined (reading 'check_suite')

The handleResults function in nop mode unconditionally accesses
payload.check_run.check_suite, which only exists in the webhook flow. The sync
itself completes; only the Check Run reporting fails.

This is a known upstream bug:

• Issue: github-community-projects/safe-settings#818
• Fix PR: github-community-projects/safe-settings#1018 (open, not yet merged)

Fix: Replace npm run full-sync with a patched script that catches the check_suite
TypeError specifically and treats it as non-fatal, while preserving error handling for all
other failure modes. Tracked via TODO(safe-settings-818) for removal once the upstream
fix lands.

Verification

The GitHub App permissions were confirmed correct:

{
  "administration": "write",
  "contents": "read",
  "metadata": "read",
  "organization_administration": "write"
}

Recommended post-merge validation

1. Run with dry-run: true, repos: complytime-demos (single repo, minimal scope)
2. Verify debug output shows Allowing complytime-demos in restrictedRepos.include
3. Verify no Allowing nunya / Allowing roadmap lines appear
4. Verify check_suite reporting skipped message appears
5. If clean, run full unscoped dry-run (repos empty, dry-run: true)

Changes

File	Change
safe-settings/deployment-settings.yml	Fix patterns from regex to glob/minimatch format
.github/workflows/safe_settings_sync.yml	Rewrite scoped generation to use include + add check_suite workaround
MAINTAINING.md	Add "Known upstream workarounds" section with tracking links

[gxmiranda]

LGTM. Three-bug fix for the safe-settings sync workflow: regex-to-glob pattern correction, exclude-to-include scoping rewrite, and a pragmatic check_suite crash workaround with clear upstream tracking (TODO(safe-settings-818)). The include-based scoping is a cleaner design than the previous exclude approach. All CI checks pass.

One minor note on the error string matching in the workaround — see inline comment.

This review was generated by /review-pr (AI-assisted).

[gxmiranda]

[MEDIUM] Consider tighter error matching for the check_suite workaround

String(error).includes('check_suite') would also match any unrelated error whose message happens to contain that substring. A more specific match like String(error).includes("Cannot read properties of undefined (reading 'check_suite'") would reduce the risk of silently swallowing a genuine failure.

Low risk given the narrow execution context (only during syncInstallation), but a low-cost hardening. No action required before merge.

[marcusburghardt]

Thanks @gxmiranda . The workflow is still in test but I will prepare this hardening suggestion in a separate PR once we confirm the workflow is stable.