@@ -146,8 +146,15 @@ inputs:
     default: ""
   exclude:
     description: >-
-      Comma- or newline-separated wildcard patterns removing repositories from
-      repos: "*" discovery.
+      Comma- or newline-separated glob patterns removing repositories from
+      repos: "*" discovery, compared case-insensitively against owner/name
+      when the pattern has a "/" and against the name alone otherwise. A star
+      matches any run of characters, "?" one character, "[abc]" one of a set,
+      "[!abc]" or "[^abc]" one outside it, and one leading "!" negates the
+      pattern. Beyond those a pattern holds only letters, digits, ".", "-",
+      and "_", with at most one "/", nothing empty around it, and no side that
+      is just "." or ".."; anything else (a leading "./", a run of stars, a
+      regex token such as "(a)+") fails the run naming the fix.
     required: false
     default: ""
   topics:
 
@@ -57,7 +57,10 @@ Discovery takes six filter inputs that apply only to `repos: "*"`; setting any o
 - `archived` defaults to `skip`, because settings writes fail on archived repositories; `archived: only` is mostly useful with `mode: check`.
 - `forks` includes, excludes, or keeps only forks.
 - `topics` keeps repositories carrying at least one listed topic, so a single marker topic can opt repositories in. It is unrelated to the `topics` settings section.
-- `exclude` takes wildcard patterns where `*` matches anything: a pattern containing `/` is matched against the full `owner/name`, any other against the name alone, case-insensitively.
+- `exclude` takes glob patterns, matched case-insensitively: a pattern containing `/` against the full `owner/name`, any other against the name alone.
+  - `*` matches any run of characters, `?` one character, `[abc]` one of a set, `[!abc]` or `[^abc]` one outside it.
+  - One leading `!` negates the pattern, so `!svc-*` drops everything except the services.
+  - Beyond those operators a pattern holds only name characters (letters, digits, `.`, `-`, `_`), at most one `/` with a non-empty glob on each side, and no side that is just `.` or `..`. Anything else (a leading `./`, a run of stars, a brace, a parenthesis, a backslash, a quote, a second `/`, a class holding `*`) fails the run before discovery starts, naming the fix, as does a class like `[z-a]`. The matcher is [picomatch](https://github.com/micromatch/picomatch), confined to that grammar.
 - `affiliation` selects which relationships to the token's user qualify, passed to GitHub's `/user/repos` listing: `owner` (the default), `collaborator`, or `organization_member`. The list replaces the default, so widening discovery beyond owned repositories takes `owner,collaborator`.
 
 ## Fallback for repositories without a settings file
 
@@ -38,7 +38,7 @@ A list input (`sections`, `required-sections`, `repos`, `exclude`, `topics`, `af
 | `visibility` | <p>Keeps only repositories of this visibility in repos: "*" discovery: all (default), public, private, or internal.</p> | `false` | `""` |
 | `archived` | <p>Archived-repository policy for repos: "*" discovery: skip (default), include, or only.</p> | `false` | `""` |
 | `forks` | <p>Fork policy for repos: "*" discovery: include (default), exclude, or only.</p> | `false` | `""` |
-| `exclude` | <p>Comma- or newline-separated wildcard patterns removing repositories from repos: "*" discovery.</p> | `false` | `""` |
+| `exclude` | <p>Comma- or newline-separated glob patterns removing repositories from repos: "*" discovery, compared case-insensitively against owner/name when the pattern has a "/" and against the name alone otherwise. A star matches any run of characters, "?" one character, "[abc]" one of a set, "[!abc]" or "[^abc]" one outside it, and one leading "!" negates the pattern. Beyond those a pattern holds only letters, digits, ".", "-", and "_", with at most one "/", nothing empty around it, and no side that is just "." or ".."; anything else (a leading "./", a run of stars, a regex token such as "(a)+") fails the run naming the fix.</p> | `false` | `""` |
 | `topics` | <p>Comma- or newline-separated topics, of which repos: "*" discovery keeps the repositories carrying at least one.</p> | `false` | `""` |
 | `affiliation` | <p>Comma- or newline-separated affiliations for repos: "*" discovery: owner (default), collaborator, or organization_member.</p> | `false` | `""` |
 <!-- action-docs-inputs source="action.yml" -->
 
@@ -246,6 +246,8 @@ const renderExitCode = runRender(
 | `discoverRepos` | function | The repositories a token can see, filtered |
 | `DiscoveryFilters` | type | The filters: `visibility`, `archived`, `forks`, `affiliation`, `topics`, `exclude` |
 | `DEFAULT_DISCOVERY_FILTERS` | const | The action's defaults |
+| `compileExcludePattern` | function | One `exclude` glob compiled once, or the problem naming why it is unusable and the fix |
+| `ExcludePattern` | type | A compiled `exclude` entry: the operator's text, the scope its slash chose, and the regex |
 | `parseReposInput` | function | The `repos` input form: slugs, or `"*"` for discovery |
 | `resolveCentralTargets` | function | The `<owner>/<name>.yml` files of a repos-dir as targets, with warnings for the files it skipped |
 | `dedupeTargets` | function | Merge the central and the remote targets, central first; a remote target whose slug a central one already names is dropped with a notice |
 
@@ -1281,6 +1281,38 @@ v3            tryList("/repos/o/r/labels", { perPage: 100 })               // re
 
 Fix: add `tryList` to every `GitHubClient` double: answer the pages your `tryRequest` route table would (`per_page=N&page=K` from 1, until a page is short) and return their bodies as `{ data: [...] }`; a client over another transport returns each page's body as received, and honors `until` by stopping after the first page it accepts.
 
+## 61. Discovery: `exclude` patterns are globs under an owned grammar
+
+For every `repos: "*"` workflow that sets `exclude`, and for `@vivswan/github-settings-as-code` consumers building `DiscoveryFilters`. In v2 an `exclude` pattern knew one operator, `*`, and matched every other character literally, so a `?`, a `[`, or a leading `!` could only ever match nothing. In v3 the pattern is a glob matched by picomatch inside a grammar the input boundary owns: `*` any run of characters, `?` one character, `[abc]` one of a set, `[!abc]` or `[^abc]` one outside it, one leading `!` negating the whole pattern, and beyond those only name characters (letters, digits, `.`, `-`, `_`) with at most one `/`. The scope rule is unchanged: a pattern with `/` matches `owner/name`, any other the name alone, case-insensitively.
+
+Two kinds of pattern move:
+
+- A pattern that gains glob meaning: `tmp-?`, `svc-[ab]`, `!svc-*`. Each matched nothing in v2; in v3 `!svc-*` excludes every repository that is not a service.
+- A pattern outside the grammar fails the run before discovery starts, naming the fix: a leading `./` (drop it), a run of stars (write one `*`), a `.` or `..` side (`x/..`), a second `/`, a doubled `!!`, or a regex token (`(a)+`, `\d`, `{a..b}`, a quote). The pattern is your input, so it is refused, never repaired.
+
+```text
+v2   exclude: "!svc-*"    -> matched nothing, every repository discovered
+v3   exclude: "!svc-*"    -> excludes every repository whose name is not svc-*
+     notice: repos: "*" discovery skipped 2 repositories by exclude pattern "!svc-*": o/tooling, o/website
+
+v2   exclude: "./tmp-**"  -> matched nothing
+v3   exclude: "./tmp-**"  -> error: the "exclude" input pattern "./tmp-**" is not a usable glob: it starts with "./", which names no owner, so drop every leading "./", and it holds a run of stars, which matches no more than one "*" does, so write one "*". Write ...
+
+v3   exclude: "svc-(a)+"  -> error: the "exclude" input pattern "svc-(a)+" is not a usable glob: it holds "(", ")", "+", which no owner or repository name contains, so remove them. Write ...
+```
+
+Fix: delete a pattern that relied on `?`, `[`, `]`, or `!` matching literally, since it never matched a repository; rewrite one that meant a glob in the grammar above, following the fix each refusal names.
+
+For library callers, `DiscoveryFilters.exclude` takes compiled `ExcludePattern` values instead of strings: run each pattern through `compileExcludePattern` at your input boundary.
+
+```text
+v2   discoverRepos(client, { ...DEFAULT_DISCOVERY_FILTERS, exclude: ["tmp-*"] });
+
+v3   const exclude = compileExcludePattern("tmp-*");
+     if (exclude.isErr()) throw new Error(describeProblem(exclude.error));
+     discoverRepos(client, { ...DEFAULT_DISCOVERY_FILTERS, exclude: [exclude.value] });
+```
+
 ## Order of operations
 
 1. Rename any settings file whose path contains a comma, rename `undeclared` to `_undeclared` in every settings file, and move every other underscore key into a YAML comment; the v2 line accepts the old spellings only, so do all three together with the pin move.
 
@@ -77,6 +77,7 @@
     "consola": "3.4.2",
     "neverthrow": "8.2.0",
     "picocolors": "1.1.1",
+    "picomatch": "4.0.7",
     "yaml": "2.9.1",
     "zod": "4.6.5"
   },
@@ -90,6 +91,7 @@
     "@octokit/openapi-webhooks": "12.1.0",
     "@types/bun": "1.4.2",
     "@types/node": "26.6.4",
+    "@types/picomatch": "4.0.3",
     "action-docs": "2.5.1",
     "ajv": "8.20.0",
     "ajv-formats": "3.0.1",
 
@@ -5,7 +5,8 @@
  */
 
 import type { components } from "@octokit/openapi-types";
-import { err, ok, ResultAsync } from "neverthrow";
+import { err, ok, type Result, ResultAsync } from "neverthrow";
+import picomatch from "picomatch/posix";
 import type { GitHubClient } from "../github/api.js";
 import { classifyApiError } from "../github/api-error.js";
 import { classifyVisibility } from "../github/repo-visibility.js";
@@ -63,7 +64,7 @@ export interface DiscoveryFilters {
   forks: (typeof FORKS_FILTERS)[number];
   affiliation: string[];
   topics: string[];
-  exclude: string[];
+  exclude: ExcludePattern[];
 }
 
 export const DEFAULT_DISCOVERY_FILTERS: DiscoveryFilters = {
@@ -75,14 +76,129 @@ export const DEFAULT_DISCOVERY_FILTERS: DiscoveryFilters = {
   exclude: [],
 };
 
-function compileExcludePattern(pattern: string): RegExp {
-  const escaped = pattern.replace(/[.+^${}()|[\]\\?]/g, "\\$&").replace(/\*/g, ".*");
-  return new RegExp(`^${escaped}$`, "i");
+/**
+ * One `exclude` entry, compiled once at the input boundary. Plain data on purpose: a config built from argv must
+ * equal one built from the environment, so the matcher is picomatch's RegExp, not a closure over it.
+ */
+export interface ExcludePattern {
+  /** The operator's text, for the skip notice. */
+  readonly pattern: string;
+  /** "slug" when the pattern has a "/" and is compared against owner/name, "name" when against the name alone. */
+  readonly scope: "slug" | "name";
+  readonly regex: RegExp;
+}
+
+/**
+ * `nocase`: repository names compare case-insensitively on GitHub. `dot`: a leading "." is an ordinary character
+ * in a repository name (".github"), not the hidden-file marker picomatch skips by default. `posix`: "[!ab]" is a
+ * negated class, as in a shell, instead of a class holding "!". `fastpaths: false`: the shortcut regexes picomatch
+ * mints for star-led patterns demand a character after a literal dot, so "*.*" would miss "archive."; the full
+ * parser keeps "*" any run of characters. `debug`: an invalid class like "[z-a]" throws instead of compiling to a
+ * never-matching regex. The posix entry point keeps the matcher platform-independent, since a slug is a GitHub
+ * identifier, not a path.
+ */
+const EXCLUDE_GLOB_OPTIONS = {
+  nocase: true,
+  dot: true,
+  posix: true,
+  fastpaths: false,
+  debug: true,
+} as const;
+
+/** Every character no owner or repository name holds and no glob operator here uses. */
+const EXCLUDE_STRAYS = /[^\w.\-/*?[\]!^]/g;
+
+/** One side of the "/": name characters, "*", "?", and classes "[abc]" or "[!abc]" over name characters. */
+const EXCLUDE_SEGMENT = /^(?:[\w.\-*?]|\[[!^]?[\w.-]+\])+$/;
+
+/**
+ * The grammar is owned here, not left to picomatch, because picomatch accepts far more than a repository name can
+ * hold ("(a)+" a quantifier, "\d" a digit class, "{az..bz}" a range, "./" silently dropped, "***" losing the
+ * escape of a later dot) and compiles several such inputs to a wrong or never-matching regex with no option to
+ * refuse them. The pattern is the user's input, so a flaw is refused naming its fix, never repaired, and every
+ * flaw of one pattern is named at once, so N flaws cost one run to discover, not N: each check runs on the
+ * pattern as the fixes named before it would leave it, and picomatch's own refusal is probed on that view too.
+ * Only an empty body ends the pass, since nothing is left to judge.
+ */
+function excludePatternFlaws(pattern: string): string[] {
+  const flaws: string[] = [];
+  const trimmed = pattern.trim();
+  if (trimmed !== pattern) {
+    flaws.push("it is wrapped in whitespace, so trim it");
+  }
+  const strays = [...new Set(trimmed.match(EXCLUDE_STRAYS) ?? [])];
+  if (strays.length > 0) {
+    const listed = strays.map((stray) => `"${stray}"`).join(", ");
+    const them = strays.length === 1 ? "it" : "them";
+    flaws.push(`it holds ${listed}, which no owner or repository name contains, so remove ${them}`);
+  }
+  const view = trimmed.replace(EXCLUDE_STRAYS, "");
+  const negated = view.startsWith("!");
+  let body = negated ? view.slice(1) : view;
+  if (body.startsWith("./")) {
+    flaws.push(`it starts with "./", which names no owner, so drop every leading "./"`);
+    body = body.replace(/^(?:\.\/)+/, "");
+  }
+  if (body === "") {
+    flaws.push(negated ? `"!" has nothing to negate` : "it is empty");
+    return flaws;
+  }
+  const segments = body.split("/");
+  if (segments.length > 2 || segments.includes("")) {
+    flaws.push(`it takes at most one "/", with a non-empty glob on each side of it`);
+  }
+  const sides = segments.filter((segment) => segment !== "");
+  if (sides.some((side) => side === "." || side === "..")) {
+    flaws.push(`"." and ".." are never names`);
+  }
+  if (body.includes("**")) {
+    flaws.push(
+      `it holds a run of stars, which matches no more than one "*" does, so write one "*"`,
+    );
+  }
+  if (!sides.every((side) => EXCLUDE_SEGMENT.test(side))) {
+    flaws.push(
+      `"!" negates only at the start or as the first character of a class, "^" only as the first character ` +
+        `of a class, and a class is "[", name characters, "]" on one side of the "/"`,
+    );
+  }
+  if (flaws.length > 0) {
+    const fixed = `${negated ? "!" : ""}${body.replace(/\*{2,}/g, "*")}`;
+    try {
+      picomatch.makeRe(fixed, EXCLUDE_GLOB_OPTIONS);
+    } catch (error) {
+      flaws.push(error instanceof Error ? error.message : String(error));
+    }
+  }
+  return flaws;
+}
+
+/**
+ * The scope split mirrors the repos-dir `<name>.yml` vs `<owner>/<name>.yml` pairing; picomatch's own basename
+ * mode cannot express it (a slashed pattern stops matching the whole slug under it).
+ */
+export function compileExcludePattern(
+  pattern: string,
+): Result<ExcludePattern, ProblemOf<"input-exclude-pattern-invalid">> {
+  const flaws = excludePatternFlaws(pattern);
+  if (flaws.length > 0) {
+    return err({ code: "input-exclude-pattern-invalid", pattern, reason: flaws.join(", and ") });
+  }
+  const scope = pattern.includes("/") ? "slug" : "name";
+  try {
+    return ok({ pattern, scope, regex: picomatch.makeRe(pattern, EXCLUDE_GLOB_OPTIONS) });
+  } catch (error) {
+    return err({
+      code: "input-exclude-pattern-invalid",
+      pattern,
+      reason: error instanceof Error ? error.message : String(error),
+    });
+  }
 }
 
-export function excludeMatches(pattern: string, slug: string): boolean {
-  const candidate = pattern.includes("/") ? slug : (slug.split("/")[1] ?? slug);
-  return compileExcludePattern(pattern).test(candidate);
+export function excludeMatches(exclude: ExcludePattern, slug: string): boolean {
+  const candidate = exclude.scope === "slug" ? slug : slug.slice(slug.indexOf("/") + 1);
+  return exclude.regex.test(candidate);
 }
 
 export interface DiscoveryResult {
@@ -188,8 +304,8 @@ function applyFilters(
       return null;
     },
     (repo) => {
-      const hit = filters.exclude.find((pattern) => excludeMatches(pattern, repo.full_name));
-      return hit ? `exclude pattern "${hit}"` : null;
+      const hit = filters.exclude.find((exclude) => excludeMatches(exclude, repo.full_name));
+      return hit ? `exclude pattern "${hit.pattern}"` : null;
     },
   ];
   const kept: DiscoveredRepoRef[] = [];
 
@@ -7,8 +7,10 @@ import { err, ok, type Result, safeTry } from "neverthrow";
 import {
   AFFILIATIONS,
   ARCHIVED_FILTERS,
+  compileExcludePattern,
   DEFAULT_DISCOVERY_FILTERS,
   type DiscoveryFilters,
+  type ExcludePattern,
   FORKS_FILTERS,
   VISIBILITY_FILTERS,
 } from "../discovery/discover.js";
@@ -196,13 +198,9 @@ export function readDiscoveryFilters(
         allowed: AFFILIATIONS,
       });
     }
-    const exclude = input.list("exclude");
-    const unmatchable = exclude.find((pattern) => {
-      const parts = pattern.split("/");
-      return parts.length > 2 || (parts.length === 2 && (!parts[0] || !parts[1]));
-    });
-    if (unmatchable !== undefined) {
-      return err({ code: "input-exclude-pattern-invalid", pattern: unmatchable });
+    const exclude: ExcludePattern[] = [];
+    for (const pattern of input.list("exclude")) {
+      exclude.push(yield* compileExcludePattern(pattern));
     }
     const discoveryFilters: DiscoveryFilters = {
       visibility,
 
@@ -181,8 +181,13 @@ export const INPUT_DECLS = {
   },
   exclude: {
     description:
-      'Comma- or newline-separated wildcard patterns removing repositories from repos: "*" ' +
-      "discovery.",
+      'Comma- or newline-separated glob patterns removing repositories from repos: "*" discovery, compared ' +
+      'case-insensitively against owner/name when the pattern has a "/" and against the name alone ' +
+      'otherwise. A star matches any run of characters, "?" one character, "[abc]" one of a set, "[!abc]" ' +
+      'or "[^abc]" one outside it, and one leading "!" negates the pattern. Beyond those a pattern holds ' +
+      'only letters, digits, ".", "-", and "_", with at most one "/", nothing empty around it, and no side ' +
+      'that is just "." or ".."; anything else (a leading "./", a run of stars, a regex token such as ' +
+      '"(a)+") fails the run naming the fix.',
     default: "",
     list: true,
   },