@@ -146,8 +146,16 @@ inputs:
     default: ""
   exclude:
     description: >-
-      Comma- or newline-separated wildcard patterns removing repositories from
-      repos: "*" discovery.
+      Comma- or newline-separated glob patterns removing repositories from
+      repos: "*" discovery, compared case-insensitively against owner/name
+      when the pattern has a "/" and against the name alone otherwise. A star
+      matches any run of characters, "?" one character, "[abc]" one of a set,
+      "[!abc]" or "[^abc]" one outside it, and one leading "!" negates the
+      pattern. A leading "./" and a run of stars are repaired and noted in the
+      run output. Beyond those a pattern holds only letters, digits, ".", "-",
+      and "_", with at most one "/", nothing empty around it, and no side that
+      is just "." or ".."; anything else, a regex token such as "(a)+"
+      included, fails the run naming the fix.
     required: false
     default: ""
   topics:
 
@@ -57,7 +57,11 @@ Discovery takes six filter inputs that apply only to `repos: "*"`; setting any o
 - `archived` defaults to `skip`, because settings writes fail on archived repositories; `archived: only` is mostly useful with `mode: check`.
 - `forks` includes, excludes, or keeps only forks.
 - `topics` keeps repositories carrying at least one listed topic, so a single marker topic can opt repositories in. It is unrelated to the `topics` settings section.
-- `exclude` takes wildcard patterns where `*` matches anything: a pattern containing `/` is matched against the full `owner/name`, any other against the name alone, case-insensitively.
+- `exclude` takes glob patterns, matched case-insensitively: a pattern containing `/` against the full `owner/name`, any other against the name alone.
+  - `*` matches any run of characters, `?` one character, `[abc]` one of a set, `[!abc]` or `[^abc]` one outside it.
+  - One leading `!` negates the pattern, so `!svc-*` drops everything except the services.
+  - A leading `./` and a run of stars are repaired, not refused: `./tmp-**` runs as `tmp-*`, and a notice names the pattern as written and as matched.
+  - Beyond those operators a pattern holds only name characters (letters, digits, `.`, `-`, `_`), at most one `/` with a non-empty glob on each side, and no side that is just `.` or `..`. Anything else (a brace, a parenthesis, a backslash, a quote, a second `/`, a class holding `*`) fails the run before discovery starts, as does a class like `[z-a]`. The matcher is [picomatch](https://github.com/micromatch/picomatch), confined to that grammar.
 - `affiliation` selects which relationships to the token's user qualify, passed to GitHub's `/user/repos` listing: `owner` (the default), `collaborator`, or `organization_member`. The list replaces the default, so widening discovery beyond owned repositories takes `owner,collaborator`.
 
 ## Fallback for repositories without a settings file
 
@@ -38,7 +38,7 @@ A list input (`sections`, `required-sections`, `repos`, `exclude`, `topics`, `af
 | `visibility` | <p>Keeps only repositories of this visibility in repos: "*" discovery: all (default), public, private, or internal.</p> | `false` | `""` |
 | `archived` | <p>Archived-repository policy for repos: "*" discovery: skip (default), include, or only.</p> | `false` | `""` |
 | `forks` | <p>Fork policy for repos: "*" discovery: include (default), exclude, or only.</p> | `false` | `""` |
-| `exclude` | <p>Comma- or newline-separated wildcard patterns removing repositories from repos: "*" discovery.</p> | `false` | `""` |
+| `exclude` | <p>Comma- or newline-separated glob patterns removing repositories from repos: "*" discovery, compared case-insensitively against owner/name when the pattern has a "/" and against the name alone otherwise. A star matches any run of characters, "?" one character, "[abc]" one of a set, "[!abc]" or "[^abc]" one outside it, and one leading "!" negates the pattern. A leading "./" and a run of stars are repaired and noted in the run output. Beyond those a pattern holds only letters, digits, ".", "-", and "_", with at most one "/", nothing empty around it, and no side that is just "." or ".."; anything else, a regex token such as "(a)+" included, fails the run naming the fix.</p> | `false` | `""` |
 | `topics` | <p>Comma- or newline-separated topics, of which repos: "*" discovery keeps the repositories carrying at least one.</p> | `false` | `""` |
 | `affiliation` | <p>Comma- or newline-separated affiliations for repos: "*" discovery: owner (default), collaborator, or organization_member.</p> | `false` | `""` |
 <!-- action-docs-inputs source="action.yml" -->
 
@@ -244,6 +244,9 @@ const renderExitCode = runRender(
 | `discoverRepos` | function | The repositories a token can see, filtered |
 | `DiscoveryFilters` | type | The filters: `visibility`, `archived`, `forks`, `affiliation`, `topics`, `exclude` |
 | `DEFAULT_DISCOVERY_FILTERS` | const | The action's defaults |
+| `compileExcludePattern` | function | One `exclude` glob healed and compiled once, or the problem naming why it is unusable |
+| `ExcludePattern` | type | A compiled `exclude` entry: the pattern as written, as matched after the heals, the scope its slash chose, and the regex |
+| `formatHealNotice` | function | The notice the action prints for a healed `exclude` entry, naming it as written and as matched, or null when nothing was healed |
 | `parseReposInput` | function | The `repos` input form: slugs, or `"*"` for discovery |
 | `resolveCentralTargets` | function | The `<owner>/<name>.yml` files of a repos-dir as targets, with warnings for the files it skipped |
 | `dedupeTargets` | function | Merge the central and the remote targets, central first; a remote target whose slug a central one already names is dropped with a notice |
 
@@ -1265,6 +1265,40 @@ v3            merge build(deps): bump yaml   -> green -> no release-PR refresh
 
 Fix: nothing for a consumer of `@next`. For a build of one exact commit, install the packaged commit (`github:Vivswan/github-settings-as-code#<packaged sha>`, from a `build/<position>.<sha7>` tag, the ten newest kept, or a release tag).
 
+## 61. Discovery: `exclude` patterns are globs under an owned grammar
+
+For every `repos: "*"` workflow that sets `exclude`, and for `@vivswan/github-settings-as-code` consumers building `DiscoveryFilters`. In v2 an `exclude` pattern knew one operator, `*`, and matched every other character literally, so a `?`, a `[`, or a leading `!` could only ever match nothing. In v3 the pattern is a glob matched by picomatch inside a grammar the input boundary owns: `*` any run of characters, `?` one character, `[abc]` one of a set, `[!abc]` or `[^abc]` one outside it, one leading `!` negating the whole pattern, and beyond those only name characters (letters, digits, `.`, `-`, `_`) with at most one `/`. The scope rule is unchanged: a pattern with `/` matches `owner/name`, any other the name alone, case-insensitively.
+
+Three kinds of pattern move:
+
+- A pattern that gains glob meaning: `tmp-?`, `svc-[ab]`, `!svc-*`. Each matched nothing in v2; in v3 `!svc-*` excludes every repository that is not a service.
+- A pattern with one unambiguous repair is healed and the run says so in a notice: a leading `./` drops and a run of stars becomes one `*`. `./tmp-**` runs as `tmp-*`.
+- A pattern outside the grammar fails the run before discovery starts, naming the fix: a `.` or `..` side (`x/..`), a second `/`, a doubled `!!`, or a regex token (`(a)+`, `\d`, `{a..b}`, a quote).
+
+```text
+v2   exclude: "!svc-*"    -> matched nothing, every repository discovered
+v3   exclude: "!svc-*"    -> excludes every repository whose name is not svc-*
+     notice: repos: "*" discovery skipped 2 repositories by exclude pattern "!svc-*": o/tooling, o/website
+
+v2   exclude: "./tmp-**"  -> matched nothing
+v3   exclude: "./tmp-**"  -> runs as tmp-*
+     notice: repos: "*" discovery healed the exclude pattern "./tmp-**" to "tmp-*"
+
+v3   exclude: "svc-(a)+"  -> error: the "exclude" input pattern "svc-(a)+" is not a usable glob: it holds "(", ...
+```
+
+Fix: delete a pattern that relied on `?`, `[`, `]`, or `!` matching literally, since it never matched a repository; rewrite one that meant a glob in the grammar above, and check the notices of the first run for a heal you did not intend.
+
+For library callers, `DiscoveryFilters.exclude` takes compiled `ExcludePattern` values instead of strings: run each pattern through `compileExcludePattern` at your input boundary, and read `formatHealNotice` for the repair line the action prints.
+
+```text
+v2   discoverRepos(client, { ...DEFAULT_DISCOVERY_FILTERS, exclude: ["tmp-*"] });
+
+v3   const exclude = compileExcludePattern("tmp-*");
+     if (exclude.isErr()) throw new Error(describeProblem(exclude.error));
+     discoverRepos(client, { ...DEFAULT_DISCOVERY_FILTERS, exclude: [exclude.value] });
+```
+
 ## Order of operations
 
 1. Rename any settings file whose path contains a comma, rename `undeclared` to `_undeclared` in every settings file, and move every other underscore key into a YAML comment; the v2 line accepts the old spellings only, so do all three together with the pin move.
 
@@ -76,6 +76,7 @@
     "consola": "3.4.2",
     "neverthrow": "8.2.0",
     "picocolors": "1.1.1",
+    "picomatch": "4.0.7",
     "yaml": "2.9.1",
     "zod": "4.6.5"
   },
@@ -89,6 +90,7 @@
     "@octokit/openapi-webhooks": "12.1.0",
     "@types/bun": "1.4.2",
     "@types/node": "26.6.4",
+    "@types/picomatch": "4.0.3",
     "action-docs": "2.5.1",
     "ajv": "8.20.0",
     "ajv-formats": "3.0.1",
 
@@ -5,7 +5,8 @@
  */
 
 import type { components } from "@octokit/openapi-types";
-import { err, ok, ResultAsync } from "neverthrow";
+import { err, ok, type Result, ResultAsync } from "neverthrow";
+import picomatch from "picomatch/posix";
 import type { GitHubClient } from "../github/api.js";
 import { classifyApiError } from "../github/api-error.js";
 import { paginate } from "../github/paginate.js";
@@ -64,7 +65,7 @@ export interface DiscoveryFilters {
   forks: (typeof FORKS_FILTERS)[number];
   affiliation: string[];
   topics: string[];
-  exclude: string[];
+  exclude: ExcludePattern[];
 }
 
 export const DEFAULT_DISCOVERY_FILTERS: DiscoveryFilters = {
@@ -76,14 +77,120 @@ export const DEFAULT_DISCOVERY_FILTERS: DiscoveryFilters = {
   exclude: [],
 };
 
-function compileExcludePattern(pattern: string): RegExp {
-  const escaped = pattern.replace(/[.+^${}()|[\]\\?]/g, "\\$&").replace(/\*/g, ".*");
-  return new RegExp(`^${escaped}$`, "i");
+/**
+ * One `exclude` entry, compiled once at the input boundary. Plain data on purpose: a config built from argv must
+ * equal one built from the environment, so the matcher is picomatch's RegExp, not a closure over it.
+ */
+export interface ExcludePattern {
+  /** The pattern as the operator wrote it. */
+  readonly written: string;
+  /** The pattern as matched: `written` after the heals; the heal notice names both when they differ. */
+  readonly pattern: string;
+  /** "slug" when the pattern has a "/" and is compared against owner/name, "name" when against the name alone. */
+  readonly scope: "slug" | "name";
+  readonly regex: RegExp;
+}
+
+/**
+ * `nocase`: repository names compare case-insensitively on GitHub. `dot`: a leading "." is an ordinary character
+ * in a repository name (".github"), not the hidden-file marker picomatch skips by default. `posix`: "[!ab]" is a
+ * negated class, as in a shell, instead of a class holding "!". `noglobstar`: "**" is "*", since a slug has one
+ * "/" and nothing to span; it also keeps picomatch's "***" parse from dropping the escape of a later dot.
+ * `fastpaths: false`: the shortcut regexes picomatch mints for star-led patterns demand a character after a
+ * literal dot, so "*.*" would miss "archive."; the full parser keeps "*" any run of characters. `debug`: an
+ * invalid class like "[z-a]" throws instead of compiling to a never-matching regex. The posix entry point keeps
+ * the matcher platform-independent, since a slug is a GitHub identifier, not a path.
+ */
+const EXCLUDE_GLOB_OPTIONS = {
+  nocase: true,
+  dot: true,
+  posix: true,
+  noglobstar: true,
+  fastpaths: false,
+  debug: true,
+} as const;
+
+/** A character no owner or repository name holds and no glob operator here uses. */
+const EXCLUDE_STRAY = /[^\w.\-/*?[\]!^]/;
+
+/** One side of the "/": name characters, "*", "?", and classes "[abc]" or "[!abc]" over name characters. */
+const EXCLUDE_SEGMENT = /^(?:[\w.\-*?]|\[[!^]?[\w.-]+\])+$/;
+
+/** Malformed input with one unambiguous repair is repaired and reported, not refused. */
+function healExcludePattern(written: string): string {
+  const trimmed = written.trim();
+  const negated = trimmed.startsWith("!");
+  const body = (negated ? trimmed.slice(1) : trimmed)
+    .replace(/^(?:\.\/)+/, "")
+    .replace(/\*{2,}/g, "*");
+  return negated ? `!${body}` : body;
+}
+
+/**
+ * The grammar is owned here, not left to picomatch, because picomatch accepts far more than a repository name can
+ * hold ("(a)+" a quantifier, "\d" a digit class, "{az..bz}" a range) and compiles several such inputs to a wrong
+ * or never-matching regex with no option to refuse them. Each flaw names its fix.
+ */
+function excludePatternFlaw(pattern: string): string | null {
+  const stray = EXCLUDE_STRAY.exec(pattern);
+  if (stray) {
+    return `it holds "${stray[0]}", which no owner or repository name contains`;
+  }
+  const negated = pattern.startsWith("!");
+  const body = negated ? pattern.slice(1) : pattern;
+  if (body === "") {
+    return negated ? `"!" has nothing to negate` : "it is empty";
+  }
+  const segments = body.split("/");
+  if (segments.length > 2 || segments.includes("")) {
+    return `it takes at most one "/", with a non-empty glob on each side of it`;
+  }
+  if (segments.some((segment) => segment === "." || segment === "..")) {
+    return `"." and ".." are never names`;
+  }
+  if (!segments.every((segment) => EXCLUDE_SEGMENT.test(segment))) {
+    return (
+      `"!" negates only at the start or as the first character of a class, "^" only as the first character ` +
+      `of a class, and a class is "[", name characters, "]" on one side of the "/"`
+    );
+  }
+  return null;
+}
+
+/**
+ * The scope split mirrors the repos-dir `<name>.yml` vs `<owner>/<name>.yml` pairing; picomatch's own basename
+ * mode cannot express it (a slashed pattern stops matching the whole slug under it).
+ */
+export function compileExcludePattern(
+  written: string,
+): Result<ExcludePattern, ProblemOf<"input-exclude-pattern-invalid">> {
+  const pattern = healExcludePattern(written);
+  const flaw = excludePatternFlaw(pattern);
+  if (flaw !== null) {
+    return err({ code: "input-exclude-pattern-invalid", pattern: written, reason: flaw });
+  }
+  const scope = pattern.includes("/") ? "slug" : "name";
+  try {
+    return ok({ written, pattern, scope, regex: picomatch.makeRe(pattern, EXCLUDE_GLOB_OPTIONS) });
+  } catch (error) {
+    return err({
+      code: "input-exclude-pattern-invalid",
+      pattern: written,
+      reason: error instanceof Error ? error.message : String(error),
+    });
+  }
+}
+
+/** The run-output line for a healed pattern, naming it as written and as matched; null when nothing was healed. */
+export function formatHealNotice(exclude: ExcludePattern): string | null {
+  return exclude.written === exclude.pattern
+    ? null
+    : `repos: "*" discovery healed the exclude pattern "${exclude.written}" to "${exclude.pattern}"`;
 }
 
-export function excludeMatches(pattern: string, slug: string): boolean {
-  const candidate = pattern.includes("/") ? slug : (slug.split("/")[1] ?? slug);
-  return compileExcludePattern(pattern).test(candidate);
+export function excludeMatches(exclude: ExcludePattern, slug: string): boolean {
+  const candidate = exclude.scope === "slug" ? slug : slug.slice(slug.indexOf("/") + 1);
+  return exclude.regex.test(candidate);
 }
 
 export interface DiscoveryResult {
@@ -184,8 +291,8 @@ function applyFilters(
       return null;
     },
     (repo) => {
-      const hit = filters.exclude.find((pattern) => excludeMatches(pattern, repo.full_name));
-      return hit ? `exclude pattern "${hit}"` : null;
+      const hit = filters.exclude.find((exclude) => excludeMatches(exclude, repo.full_name));
+      return hit ? `exclude pattern "${hit.pattern}"` : null;
     },
   ];
   const kept: DiscoveredRepoRef[] = [];
 
@@ -7,8 +7,10 @@ import { err, ok, type Result, safeTry } from "neverthrow";
 import {
   AFFILIATIONS,
   ARCHIVED_FILTERS,
+  compileExcludePattern,
   DEFAULT_DISCOVERY_FILTERS,
   type DiscoveryFilters,
+  type ExcludePattern,
   FORKS_FILTERS,
   VISIBILITY_FILTERS,
 } from "../discovery/discover.js";
@@ -196,13 +198,9 @@ export function readDiscoveryFilters(
         allowed: AFFILIATIONS,
       });
     }
-    const exclude = input.list("exclude");
-    const unmatchable = exclude.find((pattern) => {
-      const parts = pattern.split("/");
-      return parts.length > 2 || (parts.length === 2 && (!parts[0] || !parts[1]));
-    });
-    if (unmatchable !== undefined) {
-      return err({ code: "input-exclude-pattern-invalid", pattern: unmatchable });
+    const exclude: ExcludePattern[] = [];
+    for (const pattern of input.list("exclude")) {
+      exclude.push(yield* compileExcludePattern(pattern));
     }
     const discoveryFilters: DiscoveryFilters = {
       visibility,
 
@@ -181,8 +181,14 @@ export const INPUT_DECLS = {
   },
   exclude: {
     description:
-      'Comma- or newline-separated wildcard patterns removing repositories from repos: "*" ' +
-      "discovery.",
+      'Comma- or newline-separated glob patterns removing repositories from repos: "*" discovery, compared ' +
+      'case-insensitively against owner/name when the pattern has a "/" and against the name alone ' +
+      'otherwise. A star matches any run of characters, "?" one character, "[abc]" one of a set, "[!abc]" ' +
+      'or "[^abc]" one outside it, and one leading "!" negates the pattern. A leading "./" and a run of ' +
+      "stars are repaired and noted in the run output. Beyond those a pattern holds " +
+      'only letters, digits, ".", "-", and "_", with at most one "/", nothing empty around it, and no side ' +
+      'that is just "." or ".."; anything else, a regex token such as "(a)+" included, fails the run naming ' +
+      "the fix.",
     default: "",
     list: true,
   },