Add include/exclude repo filters to team settings

Team entries are filtered by the same Diffable include/exclude logic that
collaborators use, but unlike collaborators those keys were never part of the
TeamSettings schema or documented, so editors and linters can't validate them.

Mirror the CollaboratorSettings allOf pattern to declare include and exclude on
TeamSettings, document both in the teams guide with examples, add a sample, and
cover the filter path with unit tests. No runtime changes.

Author: neatcoder

docs/github-settings/4. teams.md

@@ -48,5 +48,33 @@ teams:
     permission: maintain
 ```
 
+</td></tr>
+<tr><td>
+<p>&emsp;<code>exclude</code><span style="color:gray;">&emsp;<i>array</i>&emsp;</span></p>
+<p>Exclude a list of repos for this team. The team is applied to every repo in scope except those whose names match one of these glob patterns.</p>
+</td><td style="vertical-align:top">
+
+```yaml
+teams:
+  - name: SuperFriends
+    permission: maintain
+    exclude:
+      - secret-repo
+```
+
+</td></tr>
+<tr><td>
+<p>&emsp;<code>include</code><span style="color:gray;">&emsp;<i>array</i>&emsp;</span></p>
+<p>Include a list of repos for this team. The team is applied only to repos whose names match one of these glob patterns.</p>
+</td><td style="vertical-align:top">
+
+```yaml
+teams:
+  - name: SuperFriends
+    permission: maintain
+    include:
+      - public-*
+```
+
 </td></tr>
 </table>

docs/sample-settings/settings.yml

@@ -161,6 +161,16 @@ teams:
   - name: globalteam
     permission: push
     visibility: closed
+  - name: docs-team
+    permission: pull
+    # You can include a list of repos for this team and only those repos would have this team
+    include:
+      - actions-demo
+  - name: ops-team
+    permission: push
+    # You can exclude a list of repos for this team and all repos except these repos would have this team
+    exclude:
+      - actions-demo
 
 # Branch protection rules
 # See https://docs.github.com/en/rest/branches/branch-protection?apiVersion=2026-03-10#update-branch-protection for available options

schema/dereferenced/repos.json

@@ -400,53 +400,76 @@
       "type": "array",
       "items": {
         "description": "A team entry",
-        "type": "object",
-        "properties": {
-          "name": {
-            "type": "string",
-            "description": "The name of the team."
-          },
-          "description": {
-            "type": "string",
-            "description": "The description of the team."
-          },
-          "maintainers": {
-            "type": "array",
-            "description": "List GitHub usernames for organization members who will become team maintainers.",
-            "items": {
-              "type": "string"
-            }
-          },
-          "repo_names": {
-            "type": "array",
-            "description": "The full name (e.g., \"organization-name/repository-name\") of repositories to add the team to.",
-            "items": {
-              "type": "string"
-            }
-          },
-          "privacy": {
-            "type": "string",
-            "description": "The level of privacy this team should have. The options are:  \n**For a non-nested team:**  \n * `secret` - only visible to organization owners and members of this team.  \n * `closed` - visible to all members of this organization.  \nDefault: `secret`  \n**For a parent or child team:**  \n * `closed` - visible to all members of this organization.  \nDefault for child team: `closed`",
-            "enum": [
-              "secret",
-              "closed"
-            ]
-          },
-          "notification_setting": {
-            "type": "string",
-            "description": "The notification setting the team has chosen. The options are:  \n * `notifications_enabled` - team members receive notifications when the team is @mentioned.  \n * `notifications_disabled` - no one receives notifications.  \nDefault: `notifications_enabled`",
-            "enum": [
-              "notifications_enabled",
-              "notifications_disabled"
+        "allOf": [
+          {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string",
+                "description": "The name of the team."
+              },
+              "description": {
+                "type": "string",
+                "description": "The description of the team."
+              },
+              "maintainers": {
+                "type": "array",
+                "description": "List GitHub usernames for organization members who will become team maintainers.",
+                "items": {
+                  "type": "string"
+                }
+              },
+              "repo_names": {
+                "type": "array",
+                "description": "The full name (e.g., \"organization-name/repository-name\") of repositories to add the team to.",
+                "items": {
+                  "type": "string"
+                }
+              },
+              "privacy": {
+                "type": "string",
+                "description": "The level of privacy this team should have. The options are:  \n**For a non-nested team:**  \n * `secret` - only visible to organization owners and members of this team.  \n * `closed` - visible to all members of this organization.  \nDefault: `secret`  \n**For a parent or child team:**  \n * `closed` - visible to all members of this organization.  \nDefault for child team: `closed`",
+                "enum": [
+                  "secret",
+                  "closed"
+                ]
+              },
+              "notification_setting": {
+                "type": "string",
+                "description": "The notification setting the team has chosen. The options are:  \n * `notifications_enabled` - team members receive notifications when the team is @mentioned.  \n * `notifications_disabled` - no one receives notifications.  \nDefault: `notifications_enabled`",
+                "enum": [
+                  "notifications_enabled",
+                  "notifications_disabled"
+                ]
+              },
+              "parent_team_id": {
+                "type": "integer",
+                "description": "The ID of a team to set as the parent team."
+              }
+            },
+            "required": [
+              "name"
             ]
           },
-          "parent_team_id": {
-            "type": "integer",
-            "description": "The ID of a team to set as the parent team."
+          {
+            "type": "object",
+            "properties": {
+              "exclude": {
+                "description": "You can exclude a list of repos for this team and all repos except these repos would have this team",
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              },
+              "include": {
+                "description": "You can include a list of repos for this team and only those repos would have this team",
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              }
+            }
           }
-        },
-        "required": [
-          "name"
         ]
       }
     },
@@ -1214,53 +1237,76 @@
     },
     "TeamSettings": {
       "description": "A team entry",
-      "type": "object",
-      "properties": {
-        "name": {
-          "type": "string",
-          "description": "The name of the team."
-        },
-        "description": {
-          "type": "string",
-          "description": "The description of the team."
-        },
-        "maintainers": {
-          "type": "array",
-          "description": "List GitHub usernames for organization members who will become team maintainers.",
-          "items": {
-            "type": "string"
-          }
-        },
-        "repo_names": {
-          "type": "array",
-          "description": "The full name (e.g., \"organization-name/repository-name\") of repositories to add the team to.",
-          "items": {
-            "type": "string"
-          }
-        },
-        "privacy": {
-          "type": "string",
-          "description": "The level of privacy this team should have. The options are:  \n**For a non-nested team:**  \n * `secret` - only visible to organization owners and members of this team.  \n * `closed` - visible to all members of this organization.  \nDefault: `secret`  \n**For a parent or child team:**  \n * `closed` - visible to all members of this organization.  \nDefault for child team: `closed`",
-          "enum": [
-            "secret",
-            "closed"
-          ]
-        },
-        "notification_setting": {
-          "type": "string",
-          "description": "The notification setting the team has chosen. The options are:  \n * `notifications_enabled` - team members receive notifications when the team is @mentioned.  \n * `notifications_disabled` - no one receives notifications.  \nDefault: `notifications_enabled`",
-          "enum": [
-            "notifications_enabled",
-            "notifications_disabled"
+      "allOf": [
+        {
+          "type": "object",
+          "properties": {
+            "name": {
+              "type": "string",
+              "description": "The name of the team."
+            },
+            "description": {
+              "type": "string",
+              "description": "The description of the team."
+            },
+            "maintainers": {
+              "type": "array",
+              "description": "List GitHub usernames for organization members who will become team maintainers.",
+              "items": {
+                "type": "string"
+              }
+            },
+            "repo_names": {
+              "type": "array",
+              "description": "The full name (e.g., \"organization-name/repository-name\") of repositories to add the team to.",
+              "items": {
+                "type": "string"
+              }
+            },
+            "privacy": {
+              "type": "string",
+              "description": "The level of privacy this team should have. The options are:  \n**For a non-nested team:**  \n * `secret` - only visible to organization owners and members of this team.  \n * `closed` - visible to all members of this organization.  \nDefault: `secret`  \n**For a parent or child team:**  \n * `closed` - visible to all members of this organization.  \nDefault for child team: `closed`",
+              "enum": [
+                "secret",
+                "closed"
+              ]
+            },
+            "notification_setting": {
+              "type": "string",
+              "description": "The notification setting the team has chosen. The options are:  \n * `notifications_enabled` - team members receive notifications when the team is @mentioned.  \n * `notifications_disabled` - no one receives notifications.  \nDefault: `notifications_enabled`",
+              "enum": [
+                "notifications_enabled",
+                "notifications_disabled"
+              ]
+            },
+            "parent_team_id": {
+              "type": "integer",
+              "description": "The ID of a team to set as the parent team."
+            }
+          },
+          "required": [
+            "name"
           ]
         },
-        "parent_team_id": {
-          "type": "integer",
-          "description": "The ID of a team to set as the parent team."
+        {
+          "type": "object",
+          "properties": {
+            "exclude": {
+              "description": "You can exclude a list of repos for this team and all repos except these repos would have this team",
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            },
+            "include": {
+              "description": "You can include a list of repos for this team and only those repos would have this team",
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          }
         }
-      },
-      "required": [
-        "name"
       ]
     },
     "MilestoneSettings": {