Merge branch 'main-enterprise' into fix/paginate-variables-narrow

Author: cdav

docs/github-settings/4. teams.md

@@ -48,5 +48,33 @@ teams:
     permission: maintain
 ```
 
+</td></tr>
+<tr><td>
+<p>&emsp;<code>exclude</code><span style="color:gray;">&emsp;<i>array</i>&emsp;</span></p>
+<p>Exclude a list of repos for this team. The team is applied to every repo in scope except those whose names match one of these glob patterns.</p>
+</td><td style="vertical-align:top">
+
+```yaml
+teams:
+  - name: SuperFriends
+    permission: maintain
+    exclude:
+      - secret-repo
+```
+
+</td></tr>
+<tr><td>
+<p>&emsp;<code>include</code><span style="color:gray;">&emsp;<i>array</i>&emsp;</span></p>
+<p>Include a list of repos for this team. The team is applied only to repos whose names match one of these glob patterns.</p>
+</td><td style="vertical-align:top">
+
+```yaml
+teams:
+  - name: SuperFriends
+    permission: maintain
+    include:
+      - public-*
+```
+
 </td></tr>
 </table>

docs/sample-settings/settings.yml

@@ -161,6 +161,16 @@ teams:
   - name: globalteam
     permission: push
     visibility: closed
+  - name: docs-team
+    permission: pull
+    # You can include a list of repos for this team and only those repos would have this team
+    include:
+      - actions-demo
+  - name: ops-team
+    permission: push
+    # You can exclude a list of repos for this team and all repos except these repos would have this team
+    exclude:
+      - actions-demo
 
 # Branch protection rules
 # See https://docs.github.com/en/rest/branches/branch-protection?apiVersion=2026-03-10#update-branch-protection for available options

lib/settings.js

@@ -314,7 +314,7 @@ ${this.results.reduce((x, y) => {
   }
 
   async loadConfigs (repo) {
-    this.subOrgConfigs = await this.getSubOrgConfigs()
+    this.subOrgConfigs = await this.getSubOrgConfigs(repo)
     this.repoConfigs = await this.getRepoConfigs(repo)
   }
 
@@ -329,7 +329,7 @@ ${this.results.reduce((x, y) => {
   }
 
   async updateRepos (repo) {
-    this.subOrgConfigs = this.subOrgConfigs || await this.getSubOrgConfigs()
+    this.subOrgConfigs = this.subOrgConfigs || await this.getSubOrgConfigs(repo)
     // Create a new object to avoid mutating the shared this.config.repository
     // This prevents race conditions when multiple repos are processed concurrently via Promise.all
     let repoConfig = this.config.repository
@@ -753,13 +753,21 @@ ${this.results.reduce((x, y) => {
    * @param params Params to fetch the file with
    * @return The parsed YAML file
    */
-  async getSubOrgConfigs () {
+  async getSubOrgConfigs (repo) {
     try {
       // Get all suborg configs even though we might be here becuase of a suborg config change
       // we will filter them out if request is due to a suborg config change
       const overridePaths = await this.getSubOrgConfigMap()
       const subOrgConfigs = {}
 
+      // When syncing a single repo (and not processing a suborg config change),
+      // resolve suborg membership by inspecting only this repo's teams/custom
+      // properties instead of enumerating every repo of every suborg across the
+      // whole org. See getSubOrgConfigsForRepo.
+      if (repo && !this.subOrgConfigMap) {
+        return await this.getSubOrgConfigsForRepo(repo, overridePaths || [])
+      }
+
       for (const override of overridePaths) {
         const data = await this.loadYaml(override.path)
         this.log.debug(`data = ${JSON.stringify(data)}`)
@@ -830,6 +838,92 @@ ${this.results.reduce((x, y) => {
     }
   }
 
+  /**
+   * Repo-scoped variant of suborg config resolution.
+   *
+   * Instead of expanding every suborg's `suborgteams`/`suborgproperties` into the
+   * full set of matching repos across the org (many paginated, org-wide API calls),
+   * this inspects only the repo being synced: it fetches the repo's own teams and
+   * custom property values at most once each (and only if some suborg config needs
+   * them), then matches locally. Result: a single-repo event costs at most one
+   * `GET /repos/{owner}/{repo}/teams` and one `GET /repos/{owner}/{repo}/properties/values`
+   * regardless of how many suborgs/teams/properties are defined.
+   *
+   * @param {*} repo the repo being synced ({ owner, repo })
+   * @param {*} overridePaths list of suborg config files ({ name, path })
+   * @returns subOrgConfigs keyed by repo name for the suborg (if any) this repo belongs to
+   */
+  async getSubOrgConfigsForRepo (repo, overridePaths) {
+    const subOrgConfigs = {}
+    const repoName = repo.repo
+
+    // Lazily fetched and cached for this repo; only queried when a suborg config
+    // actually references teams/properties.
+    let repoTeamSlugs
+    let repoProperties
+
+    for (const override of overridePaths) {
+      const data = await this.loadYaml(override.path)
+      this.log.debug(`data = ${JSON.stringify(data)}`)
+      if (!data) { continue }
+
+      let matched = false
+
+      if (data.suborgrepos) {
+        matched = data.suborgrepos.some(pattern => new Glob(pattern).test(repoName))
+      }
+
+      if (!matched && data.suborgteams) {
+        if (repoTeamSlugs === undefined) {
+          repoTeamSlugs = (await this.getReposTeams(repo)).map(team => team.slug)
+        }
+        matched = data.suborgteams.some(teamslug => repoTeamSlugs.includes(teamslug))
+      }
+
+      if (!matched && data.suborgproperties) {
+        if (repoProperties === undefined) {
+          repoProperties = await this.getRepoCustomPropertyValues(repo)
+        }
+        matched = this.repoMatchesProperties(repoProperties, data.suborgproperties)
+      }
+
+      if (matched) {
+        this.storeSubOrgConfigIfNoConflicts(subOrgConfigs, override.path, repoName, data)
+      }
+    }
+
+    return subOrgConfigs
+  }
+
+  /**
+   * Returns true if the repo's custom property values satisfy any of the suborg
+   * property filters. Mirrors getRepositoriesByProperty by only considering the
+   * first key/value of each filter entry (e.g. `- EDP: true`). Values are compared
+   * as strings so YAML booleans/numbers match the API's string representation, and
+   * multi-select property values (arrays) match if they contain the expected value.
+   */
+  repoMatchesProperties (repoProperties, subOrgProperties) {
+    // Property names are case-insensitive in GitHub (the org-wide `props.` search
+    // relied on this, and the custom_properties plugin lowercases names for the same
+    // reason), so normalize names to lowercase on both sides before comparing.
+    const propertyValues = new Map(
+      (repoProperties || []).map(property => [String(property.property_name).toLowerCase(), property.value])
+    )
+    return subOrgProperties.some(filter => {
+      const [name] = Object.keys(filter)
+      const expected = filter[name]
+      const key = String(name).toLowerCase()
+      if (!propertyValues.has(key)) {
+        return false
+      }
+      const actual = propertyValues.get(key)
+      if (Array.isArray(actual)) {
+        return actual.map(String).includes(String(expected))
+      }
+      return String(actual) === String(expected)
+    })
+  }
+
   storeSubOrgConfigIfNoConflicts (subOrgConfigs, overridePath, repoName, data) {
     const existingConfigForRepo = subOrgConfigs[repoName]
     if (existingConfigForRepo && existingConfigForRepo.source !== overridePath) {
@@ -933,6 +1027,35 @@ ${this.results.reduce((x, y) => {
     return this.github.paginate(options)
   }
 
+  // Repo-scoped inverse of getReposForTeam: the teams a single repo belongs to.
+  async getReposTeams (repo) {
+    const options = this.github.rest.repos.listTeams.endpoint.merge({
+      owner: repo.owner,
+      repo: repo.repo,
+      per_page: 100
+    })
+    return this.github.paginate(options)
+  }
+
+  // Repo-scoped inverse of getRepositoriesByProperty: the custom property values
+  // set on a single repo. Returns an array of { property_name, value }.
+  // Uses the same typed endpoint as the custom_properties plugin
+  // (customPropertiesForReposGetRepositoryValues).
+  async getRepoCustomPropertyValues (repo) {
+    const endpoint = this.github.rest.repos.customPropertiesForReposGetRepositoryValues
+    // Octokit renamed this method (it used to be `getCustomPropertiesValues`). Passing an
+    // undefined route to paginate() does not throw - it silently requests the API root and
+    // returns junk, which makes every suborgproperties match fail with no error. Fail loudly.
+    if (typeof endpoint !== 'function') {
+      throw new Error('octokit.rest.repos.customPropertiesForReposGetRepositoryValues is not available; cannot resolve suborgproperties')
+    }
+    return this.github.paginate(endpoint, {
+      owner: repo.owner,
+      repo: repo.repo,
+      per_page: 100
+    })
+  }
+
   async getRepositoriesByProperty (organizationName, propertyFilter) {
     if (!organizationName || !propertyFilter) {
       throw new Error('Organization name and property filter are required')