Fix delta bugs: org-all precedence + repo config path; update schema

- Delta mode now skips apps configured as repository_selection: all at org
  level (org 'all' takes precedence — never add/remove repos via delta)
- Fix repo config path used to load previous version from baseRef: use
  CONFIG_PATH/repos/<repo>.yml instead of bare repos/<repo>.yml (the bare
  path 404'd, so repo-level repository_unselection was never computed)
- schema/settings.json: add app_installations top-level property and include
  it in additive_plugins and disable_plugins enums for editor validation

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: decyjphr

lib/settings.js

@@ -1525,8 +1525,24 @@ class Settings {
       }
     }
 
+    // Apps configured as "all" at the org level take precedence — they must
+    // never have repos unselected by suborg/repo deltas, and adding repos is
+    // redundant since the app already targets all repos.
+    const orgAllApps = new Set()
+    const orgAppInstallations = this.config && this.config.app_installations
+    if (Array.isArray(orgAppInstallations)) {
+      for (const appConfig of orgAppInstallations) {
+        if (appConfig && appConfig.app_slug && appConfig.repository_selection === 'all') {
+          orgAllApps.add(appConfig.app_slug)
+        }
+      }
+    }
+
     // Helper to ensure an entry exists in the change map
     const ensureEntry = (slug) => {
+      // Org-level "all" apps are fully managed by full sync; deltas must not
+      // add or remove repos for them (org "all" takes precedence).
+      if (orgAllApps.has(slug)) return null
       if (!appChangeMap.has(slug)) {
         const installationId = installationMap.get(slug)
         if (!installationId) return null
@@ -1620,7 +1636,7 @@ class Settings {
       // Load previous version of this repo config
       let previousApps = []
       if (baseRef) {
-        const repoFilePath = `repos/${repo.repo}.yml`
+        const repoFilePath = path.posix.join(CONFIG_PATH, 'repos', `${repo.repo}.yml`)
         try {
           const previousData = await this.loadYamlFromRef(repoFilePath, baseRef)
           previousApps = (previousData && previousData.app_installations) || []

schema/settings.json

@@ -234,8 +234,32 @@
         }
       }
     },
+    "app_installations": {
+      "description": "Manage which repositories a GitHub App installation can access. The target is a GitHub App installation rather than a repository. Repo selection follows the config hierarchy: org-level settings.yml selects all repos (repository_selection: all); suborgs/*.yml selects repos by the suborg's targeting criteria; repos/*.yml adds the specific repo. Requires safe-settings to be installed on the enterprise with 'Enterprise organization installations' permission.",
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": [
+          "app_slug"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "app_slug": {
+            "type": "string",
+            "description": "The slug of the GitHub App installation to manage."
+          },
+          "repository_selection": {
+            "type": "string",
+            "enum": [
+              "all"
+            ],
+            "description": "Only valid at the org level (settings.yml). 'all' selects every repository in the org and takes precedence over any suborg/repo-level selections."
+          }
+        }
+      }
+    },
     "additive_plugins": {
-      "description": "List of Diffable plugins to run in additive mode. In additive mode the plugin will only add and update entries; it will never call remove(), so items that exist on GitHub but are absent from the YAML are preserved. Only Diffable-extending plugins are supported (labels, collaborators, teams, milestones, autolinks, environments, custom_properties, variables, rulesets, custom_repository_roles). Declare only in settings.yml (org level) to keep behavior consistent across all repos.",
+      "description": "List of Diffable plugins to run in additive mode. In additive mode the plugin will only add and update entries; it will never call remove(), so items that exist on GitHub but are absent from the YAML are preserved. Only Diffable-extending plugins are supported (labels, collaborators, teams, milestones, autolinks, environments, custom_properties, variables, rulesets, custom_repository_roles). The app_installations plugin also honors additive mode (only adds repos to installations, never removes). Declare only in settings.yml (org level) to keep behavior consistent across all repos.",
       "type": "array",
       "items": {
         "type": "string",
@@ -249,7 +273,8 @@
           "custom_properties",
           "variables",
           "rulesets",
-          "custom_repository_roles"
+          "custom_repository_roles",
+          "app_installations"
         ]
       }
     },
@@ -274,7 +299,8 @@
               "custom_properties",
               "custom_repository_roles",
               "variables",
-              "archive"
+              "archive",
+              "app_installations"
             ]
           },
           {
@@ -300,7 +326,8 @@
                   "custom_properties",
                   "custom_repository_roles",
                   "variables",
-                  "archive"
+                  "archive",
+                  "app_installations"
                 ]
               },
               "target": {