feat(discovery)!: match exclude patterns with picomatch under an owned glob grammar

The exclude discovery filter compiled its own RegExp from each pattern, with "*" the only operator and every other character literal. Each pattern is now compiled once at the input boundary with picomatch (the posix entry, nocase, dot, posix classes, noglobstar, no fast paths, debug), and the boundary owns the grammar: name characters, at most one "/", "*", "?", "[abc]", "[!abc]" or "[^abc]", and one leading "!". Anything outside it is refused when the inputs are parsed, naming the reason and the fix, because picomatch reads braces, parentheses, quotes, backslashes, a leading "./", and "***" as regex syntax through paths no option closes and would otherwise compile a wrong or never-matching filter silently.

DiscoveryFilters.exclude carries the compiled ExcludePattern (pattern, scope, regex) instead of strings, so a config built from argv still equals one built from the environment, and compileExcludePattern with ExcludePattern join the library surface. The e2e oracle's independent matcher learns "?" and a leading "!", and two scenarios pin the new forms end to end.

BREAKING CHANGE: "?", "[", "]", and a leading "!" in an exclude pattern are glob operators now ("?" one character, "[abc]" a class, "!" negation), and every other non-name character ("{", "(", "|", "+", "\", quotes, spaces) is refused at parse time instead of being matched literally. A pattern that relied on one of those matching literally never matched a GitHub repository, so drop it. A pattern meant as a glob keeps working unchanged.

Author: Vivswan

action.yml

@@ -146,8 +146,14 @@ inputs:
     default: ""
   exclude:
     description: >-
-      Comma- or newline-separated wildcard patterns removing repositories from
-      repos: "*" discovery.
+      Comma- or newline-separated glob patterns removing repositories from
+      repos: "*" discovery, compared case-insensitively against owner/name
+      when the pattern has a "/" and against the name alone otherwise. A star
+      matches any run of characters, "?" one character, "[abc]" one of a set,
+      "[!abc]" or "[^abc]" one outside it, and one leading "!" negates the
+      pattern. Beyond those operators a pattern holds only letters, digits,
+      ".", "-", and "_", with at most one "/", nothing empty around it, and no
+      side that is just "." or "..".
     required: false
     default: ""
   topics:

bun.lock

@@ -57,7 +57,10 @@ Discovery takes six filter inputs that apply only to `repos: "*"`; setting any o
 - `archived` defaults to `skip`, because settings writes fail on archived repositories; `archived: only` is mostly useful with `mode: check`.
 - `forks` includes, excludes, or keeps only forks.
 - `topics` keeps repositories carrying at least one listed topic, so a single marker topic can opt repositories in. It is unrelated to the `topics` settings section.
-- `exclude` takes wildcard patterns where `*` matches anything: a pattern containing `/` is matched against the full `owner/name`, any other against the name alone, case-insensitively.
+- `exclude` takes glob patterns, matched case-insensitively: a pattern containing `/` against the full `owner/name`, any other against the name alone.
+  - `*` matches any run of characters, `?` one character, `[abc]` one of a set, `[!abc]` or `[^abc]` one outside it.
+  - One leading `!` negates the pattern, so `!svc-*` drops everything except the services.
+  - Beyond those operators a pattern holds only name characters (letters, digits, `.`, `-`, `_`), at most one `/` with a non-empty glob on each side, and no side that is just `.` or `..`. Anything else (a brace, a parenthesis, a backslash, a quote, a second `/`, a class holding `*`) fails the run before discovery starts, as does a class like `[z-a]`. The matcher is [picomatch](https://github.com/micromatch/picomatch), confined to that grammar.
 - `affiliation` selects which relationships to the token's user qualify, passed to GitHub's `/user/repos` listing: `owner` (the default), `collaborator`, or `organization_member`. The list replaces the default, so widening discovery beyond owned repositories takes `owner,collaborator`.
 
 ## Fallback for repositories without a settings file

docs/operate/multi-repo.md

@@ -38,7 +38,7 @@ A list input (`sections`, `required-sections`, `repos`, `exclude`, `topics`, `af
 | `visibility` | <p>Keeps only repositories of this visibility in repos: "*" discovery: all (default), public, private, or internal.</p> | `false` | `""` |
 | `archived` | <p>Archived-repository policy for repos: "*" discovery: skip (default), include, or only.</p> | `false` | `""` |
 | `forks` | <p>Fork policy for repos: "*" discovery: include (default), exclude, or only.</p> | `false` | `""` |
-| `exclude` | <p>Comma- or newline-separated wildcard patterns removing repositories from repos: "*" discovery.</p> | `false` | `""` |
+| `exclude` | <p>Comma- or newline-separated glob patterns removing repositories from repos: "*" discovery, compared case-insensitively against owner/name when the pattern has a "/" and against the name alone otherwise. A star matches any run of characters, "?" one character, "[abc]" one of a set, "[!abc]" or "[^abc]" one outside it, and one leading "!" negates the pattern. Beyond those operators a pattern holds only letters, digits, ".", "-", and "_", with at most one "/", nothing empty around it, and no side that is just "." or "..".</p> | `false` | `""` |
 | `topics` | <p>Comma- or newline-separated topics, of which repos: "*" discovery keeps the repositories carrying at least one.</p> | `false` | `""` |
 | `affiliation` | <p>Comma- or newline-separated affiliations for repos: "*" discovery: owner (default), collaborator, or organization_member.</p> | `false` | `""` |
 <!-- action-docs-inputs source="action.yml" -->

docs/reference/inputs.md

@@ -242,6 +242,8 @@ const renderExitCode = runRender(
 | `discoverRepos` | function | The repositories a token can see, filtered |
 | `DiscoveryFilters` | type | The filters: `visibility`, `archived`, `forks`, `affiliation`, `topics`, `exclude` |
 | `DEFAULT_DISCOVERY_FILTERS` | const | The action's defaults |
+| `compileExcludePattern` | function | One `exclude` glob compiled once, or the problem naming why it is unusable |
+| `ExcludePattern` | type | A compiled `exclude` entry: the operator's text, the scope its slash chose, and the regex |
 | `parseReposInput` | function | The `repos` input form: slugs, or `"*"` for discovery |
 | `resolveCentralTargets` | function | The `<owner>/<name>.yml` files of a repos-dir as targets, with warnings for the files it skipped |
 | `dedupeTargets` | function | Merge the central and the remote targets, central first; a remote target whose slug a central one already names is dropped with a notice |

docs/reference/library.md

@@ -76,6 +76,7 @@
     "consola": "3.4.2",
     "neverthrow": "8.2.0",
     "picocolors": "1.1.1",
+    "picomatch": "4.0.7",
     "yaml": "2.9.1",
     "zod": "4.6.5"
   },
@@ -89,6 +90,7 @@
     "@octokit/openapi-webhooks": "12.1.0",
     "@types/bun": "1.4.2",
     "@types/node": "26.6.4",
+    "@types/picomatch": "4.0.3",
     "action-docs": "2.5.1",
     "ajv": "8.20.0",
     "ajv-formats": "3.0.1",

package.json

@@ -5,7 +5,8 @@
  */
 
 import type { components } from "@octokit/openapi-types";
-import { err, ok, ResultAsync } from "neverthrow";
+import { err, ok, type Result, ResultAsync } from "neverthrow";
+import picomatch from "picomatch/posix";
 import type { GitHubClient } from "../github/api.js";
 import { classifyApiError } from "../github/api-error.js";
 import { paginate } from "../github/paginate.js";
@@ -64,7 +65,7 @@ export interface DiscoveryFilters {
   forks: (typeof FORKS_FILTERS)[number];
   affiliation: string[];
   topics: string[];
-  exclude: string[];
+  exclude: ExcludePattern[];
 }
 
 export const DEFAULT_DISCOVERY_FILTERS: DiscoveryFilters = {
@@ -76,14 +77,99 @@ export const DEFAULT_DISCOVERY_FILTERS: DiscoveryFilters = {
   exclude: [],
 };
 
-function compileExcludePattern(pattern: string): RegExp {
-  const escaped = pattern.replace(/[.+^${}()|[\]\\?]/g, "\\$&").replace(/\*/g, ".*");
-  return new RegExp(`^${escaped}$`, "i");
+/**
+ * One `exclude` entry, compiled once at the input boundary. Plain data on purpose: a config built from argv must
+ * equal one built from the environment, so the matcher is picomatch's RegExp, not a closure over it.
+ */
+export interface ExcludePattern {
+  /** The operator's text, for the skip notice. */
+  readonly pattern: string;
+  /** "slug" when the pattern has a "/" and is compared against owner/name, "name" when against the name alone. */
+  readonly scope: "slug" | "name";
+  readonly regex: RegExp;
+}
+
+/**
+ * `nocase`: repository names compare case-insensitively on GitHub. `dot`: a leading "." is an ordinary character
+ * in a repository name (".github"), not the hidden-file marker picomatch skips by default. `posix`: "[!ab]" is a
+ * negated class, as in a shell, instead of a class holding "!". `noglobstar`: "**" is "*", since a slug has one
+ * "/" and nothing to span; it also keeps picomatch's "***" parse from dropping the escape of a later dot.
+ * `fastpaths: false`: the shortcut regexes picomatch mints for star-led patterns demand a character after a
+ * literal dot, so "*.*" would miss "archive."; the full parser keeps "*" any run of characters. `debug`: an
+ * invalid class like "[z-a]" throws instead of compiling to a never-matching regex. The posix entry point keeps
+ * the matcher platform-independent, since a slug is a GitHub identifier, not a path.
+ */
+const EXCLUDE_GLOB_OPTIONS = {
+  nocase: true,
+  dot: true,
+  posix: true,
+  noglobstar: true,
+  fastpaths: false,
+  debug: true,
+} as const;
+
+/** A character no owner or repository name holds and no glob operator here uses. */
+const EXCLUDE_STRAY = /[^\w.\-/*?[\]!^]/;
+
+/** One side of the "/": name characters, "*", "?", and classes "[abc]" or "[!abc]" over name characters. */
+const EXCLUDE_SEGMENT = /^(?:[\w.\-*?]|\[[!^]?[\w.-]+\])+$/;
+
+/**
+ * The grammar is owned here, not left to picomatch, because picomatch accepts far more than a repository name can
+ * hold ("(a)+" a quantifier, "\d" a digit class, "{az..bz}" a range, a stripped leading "./") and compiles several
+ * such inputs to a wrong or never-matching regex with no option to refuse them. Each flaw names its fix.
+ */
+function excludePatternFlaw(pattern: string): string | null {
+  const stray = EXCLUDE_STRAY.exec(pattern);
+  if (stray) {
+    return `it holds "${stray[0]}", which no owner or repository name contains`;
+  }
+  const body = pattern.startsWith("!") ? pattern.slice(1) : pattern;
+  if (body === "") {
+    return `"!" has nothing to negate`;
+  }
+  const segments = body.split("/");
+  if (segments.length > 2 || segments.includes("")) {
+    return `it takes at most one "/", with a non-empty glob on each side of it`;
+  }
+  if (segments.some((segment) => segment === "." || segment === "..")) {
+    return `"." and ".." are never names`;
+  }
+  if (!segments.every((segment) => EXCLUDE_SEGMENT.test(segment))) {
+    return (
+      `"!" negates only at the start or as the first character of a class, "^" only as the first character ` +
+      `of a class, and a class is "[", name characters, "]" on one side of the "/"`
+    );
+  }
+  return null;
+}
+
+/**
+ * The scope split mirrors the repos-dir `<name>.yml` vs `<owner>/<name>.yml` pairing; picomatch's own basename
+ * mode cannot express it (a slashed pattern stops matching the whole slug under it).
+ */
+export function compileExcludePattern(
+  pattern: string,
+): Result<ExcludePattern, ProblemOf<"input-exclude-pattern-invalid">> {
+  const flaw = excludePatternFlaw(pattern);
+  if (flaw !== null) {
+    return err({ code: "input-exclude-pattern-invalid", pattern, reason: flaw });
+  }
+  const scope = pattern.includes("/") ? "slug" : "name";
+  try {
+    return ok({ pattern, scope, regex: picomatch.makeRe(pattern, EXCLUDE_GLOB_OPTIONS) });
+  } catch (error) {
+    return err({
+      code: "input-exclude-pattern-invalid",
+      pattern,
+      reason: error instanceof Error ? error.message : String(error),
+    });
+  }
 }
 
-export function excludeMatches(pattern: string, slug: string): boolean {
-  const candidate = pattern.includes("/") ? slug : (slug.split("/")[1] ?? slug);
-  return compileExcludePattern(pattern).test(candidate);
+export function excludeMatches(exclude: ExcludePattern, slug: string): boolean {
+  const candidate = exclude.scope === "slug" ? slug : slug.slice(slug.indexOf("/") + 1);
+  return exclude.regex.test(candidate);
 }
 
 export interface DiscoveryResult {
@@ -184,8 +270,8 @@ function applyFilters(
       return null;
     },
     (repo) => {
-      const hit = filters.exclude.find((pattern) => excludeMatches(pattern, repo.full_name));
-      return hit ? `exclude pattern "${hit}"` : null;
+      const hit = filters.exclude.find((exclude) => excludeMatches(exclude, repo.full_name));
+      return hit ? `exclude pattern "${hit.pattern}"` : null;
     },
   ];
   const kept: DiscoveredRepoRef[] = [];

src/discovery/discover.ts

@@ -8,8 +8,10 @@ import { err, ok, type Result, safeTry } from "neverthrow";
 import {
   AFFILIATIONS,
   ARCHIVED_FILTERS,
+  compileExcludePattern,
   DEFAULT_DISCOVERY_FILTERS,
   type DiscoveryFilters,
+  type ExcludePattern,
   FORKS_FILTERS,
   VISIBILITY_FILTERS,
 } from "../discovery/discover.js";
@@ -199,8 +201,12 @@ export const INPUT_DECLS = {
   },
   exclude: {
     description:
-      'Comma- or newline-separated wildcard patterns removing repositories from repos: "*" ' +
-      "discovery.",
+      'Comma- or newline-separated glob patterns removing repositories from repos: "*" discovery, compared ' +
+      'case-insensitively against owner/name when the pattern has a "/" and against the name alone ' +
+      'otherwise. A star matches any run of characters, "?" one character, "[abc]" one of a set, "[!abc]" ' +
+      'or "[^abc]" one outside it, and one leading "!" negates the pattern. Beyond those operators a pattern ' +
+      'holds only letters, digits, ".", "-", and "_", with at most one "/", nothing empty around it, and no ' +
+      'side that is just "." or "..".',
     default: "",
     list: true,
   },
@@ -495,13 +501,9 @@ function readDiscoveryFilters(
         allowed: AFFILIATIONS,
       });
     }
-    const exclude = input.list("exclude");
-    const unmatchable = exclude.find((pattern) => {
-      const parts = pattern.split("/");
-      return parts.length > 2 || (parts.length === 2 && (!parts[0] || !parts[1]));
-    });
-    if (unmatchable !== undefined) {
-      return err({ code: "input-exclude-pattern-invalid", pattern: unmatchable });
+    const exclude: ExcludePattern[] = [];
+    for (const pattern of input.list("exclude")) {
+      exclude.push(yield* compileExcludePattern(pattern));
     }
     const discoveryFilters: DiscoveryFilters = {
       visibility,

src/flows/inputs.ts

@@ -6,9 +6,11 @@
 
 export { resolveCentralTargets } from "./discovery/central.js";
 export {
+  compileExcludePattern,
   DEFAULT_DISCOVERY_FILTERS,
   type DiscoveryFilters,
   discoverRepos,
+  type ExcludePattern,
 } from "./discovery/discover.js";
 export { parseReposInput } from "./discovery/repos-input.js";
 export {

src/index.ts

@@ -131,7 +131,11 @@ export type Problem =
       readonly entry: string;
       readonly allowed: readonly string[];
     }
-  | { readonly code: "input-exclude-pattern-invalid"; readonly pattern: string }
+  | {
+      readonly code: "input-exclude-pattern-invalid";
+      readonly pattern: string;
+      readonly reason: string;
+    }
   | { readonly code: "input-repository-with-multi" }
   | { readonly code: "input-settings-file-with-multi" }
   | {
@@ -509,12 +513,16 @@ export function describeProblem(problem: Problem): string {
       return 'the "private-report" input delivers reports only for redacted targets, but "private-repos" is "show", so nothing is redacted and no report would ever be sent. Set private-repos: redact, or set private-report: none';
     case "input-affiliation-unsupported":
       return `the "affiliation" input entry "${problem.entry}" is not a supported affiliation, so discovery cannot build the /user/repos query. Use a comma-separated list of ${quoteList(problem.allowed)}`;
-    case "input-exclude-pattern-invalid":
+    case "input-exclude-pattern-invalid": {
+      const shown =
+        problem.pattern.length > 60 ? `${problem.pattern.slice(0, 60)}...` : problem.pattern;
       return (
-        `the "exclude" input pattern "${problem.pattern}" can never match an owner/name repository: a ` +
-        `pattern takes at most one "/", with a non-empty glob on each side of it. Use ` +
-        `"<name-glob>" or "<owner-glob>/<name-glob>", where "*" matches any characters`
+        `the "exclude" input pattern "${shown}" is not a usable glob: ${problem.reason}. Write ` +
+        `"<name-glob>" or "<owner-glob>/<name-glob>", where a glob is letters, digits, ".", "-", "_", "*", "?", ` +
+        `and the classes "[abc]" or "[!abc]" over those characters, with one optional leading "!" negating ` +
+        `the whole pattern`
       );
+    }
     case "input-repository-with-multi":
       return 'the "repository" input cannot be combined with "repos" or "repos-dir"; multi-repo targets come from those inputs. Remove "repository", or remove the multi-repo inputs to stay in single-repo mode';
     case "input-settings-file-with-multi":