Skip to content

Add include/exclude repo filters to team settings schema (backport #1009) #1038

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
decyjphr merged 4 commits into from
Jul 28, 2026
Merged

Add include/exclude repo filters to team settings schema (backport #1009) #1038

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
7e908d5
feat: add include/exclude repo filters to team settings schema
decyjphr Jul 27, 2026
0d3bc76
test(smoke): add Phase 18 for team include/exclude repo filters
decyjphr Jul 27, 2026
1998098
fix(schema): use team-repo-permissions schema for team permission values
decyjphr Jul 27, 2026
be51369
docs(schema): clarify team include/exclude are repo-name glob patterns
decyjphr Jul 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 28 additions & 0 deletions docs/github-settings/4. teams.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,5 +61,33 @@ teams:
external_group: "Engineering - Expert Services"
```

</td></tr>
<tr><td>
<p>&emsp;<code>exclude</code><span style="color:gray;">&emsp;<i>array</i>&emsp;</span></p>
<p>Exclude a list of repos for this team. The team is applied to every repo in scope except those whose names match one of these glob patterns.</p>
</td><td style="vertical-align:top">

```yaml
teams:
- name: SuperFriends
permission: maintain
exclude:
- secret-repo
```

</td></tr>
<tr><td>
<p>&emsp;<code>include</code><span style="color:gray;">&emsp;<i>array</i>&emsp;</span></p>
<p>Include a list of repos for this team. The team is applied only to repos whose names match one of these glob patterns.</p>
</td><td style="vertical-align:top">

```yaml
teams:
- name: SuperFriends
permission: maintain
include:
- public-*
```

</td></tr>
</table>
10 changes: 10 additions & 0 deletions docs/sample-settings/settings.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,6 +161,16 @@ teams:
- name: globalteam
permission: push
visibility: closed
- name: docs-team
permission: pull
# You can include a list of repos for this team and only those repos would have this team
Comment thread
decyjphr marked this conversation as resolved.
include:
- actions-demo
- name: ops-team
permission: push
# You can exclude a list of repos for this team and all repos except these repos would have this team
exclude:
- actions-demo

# Branch protection rules
# See https://docs.github.com/en/rest/branches/branch-protection?apiVersion=2022-11-28#update-branch-protection for available options
Expand Down
167 changes: 111 additions & 56 deletions schema/dereferenced/settings.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -419,62 +419,54 @@
"description": "Teams",
"type": "array",
"items": {
"type": "object",
"properties": {
"name": {
"type": "string",
"description": "The name of the team."
},
"description": {
"type": "string",
"description": "The description of the team."
},
"maintainers": {
"type": "array",
"description": "List GitHub usernames for organization members who will become team maintainers.",
"items": {
"type": "string"
}
},
"repo_names": {
"type": "array",
"description": "The full name (e.g., \"organization-name/repository-name\") of repositories to add the team to.",
"items": {
"type": "string"
"allOf": [
{
"type": "object",
"properties": {
"permission": {
"type": "string",
"description": "The permission to grant the team on this repository. We accept the following permissions to be set: `pull`, `triage`, `push`, `maintain`, `admin` and you can also specify a custom repository role name, if the owning organization has defined any. If no permission is specified, the team's `permission` attribute will be used to determine what permission to grant the team on this repository."
}
}
},
"privacy": {
"type": "string",
"description": "The level of privacy this team should have. The options are: \n**For a non-nested team:** \n * `secret` - only visible to organization owners and members of this team. \n * `closed` - visible to all members of this organization. \nDefault: `secret` \n**For a parent or child team:** \n * `closed` - visible to all members of this organization. \nDefault for child team: `closed`",
"enum": [
"secret",
"closed"
]
},
"notification_setting": {
"type": "string",
"description": "The notification setting the team has chosen. The options are: \n * `notifications_enabled` - team members receive notifications when the team is @mentioned. \n * `notifications_disabled` - no one receives notifications. \nDefault: `notifications_enabled`",
"enum": [
"notifications_enabled",
"notifications_disabled"
]
},
"permission": {
"type": "string",
"description": "**Closing down notice**. The permission that new repositories will be added to the team with when none is specified.",
"enum": [
"pull",
"push"
{
"type": "object",
"required": [
"name"
],
"default": "pull"
},
"parent_team_id": {
"type": "integer",
"description": "The ID of a team to set as the parent team."
"properties": {
"name": {
"description": "The name (or slug) of the team to grant access to the repo.",
"type": "string"
},
"privacy": {
"description": "The level of privacy the team should have when it is created by safe-settings. The options are `secret` (visible only to organization owners and members of the team) or `closed` (visible to all members of the organization).",
"type": "string",
"enum": [
"secret",
"closed"
]
},
"external_group": {
"description": "The display name of an external IdP group to link to this team.",
"type": "string"
},
"exclude": {
"description": "Exclude this team from repos whose names match one of these glob patterns.",
"type": "array",
"items": {
"type": "string"
}
},
"include": {
"description": "Apply this team only to repos whose names match one of these glob patterns.",
"type": "array",
"items": {
"type": "string"
}
}
}
}
},
"required": [
"name"
]
}
},
Expand Down Expand Up @@ -1223,6 +1215,49 @@
"type": "boolean",
"description": "New, reviewable commits pushed will dismiss previous pull request review approvals."
},
"dismissal_restriction": {
"title": "DismissalRestriction",
"description": "Specify people, teams, or apps allowed to dismiss pull request reviews.",
"type": "object",
"properties": {
"allowed_actors": {
"type": "array",
"description": "Specify people, teams, or apps allowed to dismiss pull request reviews.",
"items": {
"title": "Actor",
"description": "An actor allowed to dismiss pull request reviews",
"type": "object",
"properties": {
"id": {
"type": "integer",
"description": "ID of the actor that can dismiss reviews."
},
"type": {
"type": "string",
"description": "The type of the actor",
"enum": [
"User",
"Team",
"IntegrationInstallation",
"RepositoryRole"
]
}
},
"required": [
"id",
"type"
]
}
},
"enabled": {
"type": "boolean",
"description": "Whether to restrict review dismissal to specific actors."
}
},
"required": [
"enabled"
]
},
"require_code_owner_review": {
"type": "boolean",
"description": "Require an approving review in pull requests that modify files that have a designated code owner."
Expand Down Expand Up @@ -1937,8 +1972,25 @@
}
}
},
"app_installations": {
"description": "Manage which repositories a GitHub App installation can access. The target is a GitHub App installation rather than a repository. Repo selection follows the config hierarchy: org-level settings.yml selects all repos in the org; suborgs/*.yml selects repos by the suborg's targeting criteria; repos/*.yml adds the specific repo. Requires safe-settings to be installed on the enterprise with 'Enterprise organization installations' permission.",
"type": "array",
"items": {
"type": "object",
"required": [
"app_slug"
],
"additionalProperties": false,
"properties": {
"app_slug": {
"type": "string",
"description": "The slug of the GitHub App installation to manage."
}
}
}
},
"additive_plugins": {
"description": "List of Diffable plugins to run in additive mode. In additive mode the plugin will only add and update entries; it will never call remove(), so items that exist on GitHub but are absent from the YAML are preserved. Only Diffable-extending plugins are supported (labels, collaborators, teams, milestones, autolinks, environments, custom_properties, variables, rulesets, custom_repository_roles). Declare only in settings.yml (org level) to keep behavior consistent across all repos.",
"description": "List of plugins to run in additive mode. In additive mode the plugin will only add and update entries; it will never call remove(), so items that exist on GitHub but are absent from the YAML are preserved. Supported plugins: labels, collaborators, teams, milestones, autolinks, environments, custom_properties, variables, rulesets, custom_repository_roles, app_installations. Declare only in settings.yml (org level) to keep behavior consistent across all repos.",
"type": "array",
"items": {
"type": "string",
Expand All @@ -1952,7 +2004,8 @@
"custom_properties",
"variables",
"rulesets",
"custom_repository_roles"
"custom_repository_roles",
"app_installations"
]
}
},
Expand All @@ -1977,7 +2030,8 @@
"custom_properties",
"custom_repository_roles",
"variables",
"archive"
"archive",
"app_installations"
]
},
{
Expand All @@ -2003,7 +2057,8 @@
"custom_properties",
"custom_repository_roles",
"variables",
"archive"
"archive",
"app_installations"
]
},
"target": {
Expand Down
44 changes: 43 additions & 1 deletion schema/settings.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -136,7 +136,49 @@
"description": "Teams",
"type": "array",
"items": {
"$ref": "https://raw.githubusercontent.com/github/rest-api-description/main/descriptions/api.github.com/api.github.com.2022-11-28.json#/paths/~1orgs~1{org}~1teams/post/requestBody/content/application~1json/schema"
"allOf": [
{
"$ref": "https://raw.githubusercontent.com/github/rest-api-description/main/descriptions/api.github.com/api.github.com.2022-11-28.json#/paths/~1orgs~1{org}~1teams~1{team_slug}~1repos~1{owner}~1{repo}/put/requestBody/content/application~1json/schema"
},
{
Comment thread
decyjphr marked this conversation as resolved.
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"description": "The name (or slug) of the team to grant access to the repo.",
"type": "string"
},
"privacy": {
"description": "The level of privacy the team should have when it is created by safe-settings. The options are `secret` (visible only to organization owners and members of the team) or `closed` (visible to all members of the organization).",
"type": "string",
"enum": [
"secret",
"closed"
]
},
"external_group": {
"description": "The display name of an external IdP group to link to this team.",
"type": "string"
},
"exclude": {
"description": "Exclude this team from repos whose names match one of these glob patterns.",
"type": "array",
"items": {
"type": "string"
Comment thread
Copilot marked this conversation as resolved.
}
},
"include": {
"description": "Apply this team only to repos whose names match one of these glob patterns.",
"type": "array",
"items": {
"type": "string"
}
}
}
}
]
}
},
"branches": {
Expand Down
Loading
Loading