Fix suborg-applied settings not removed when targeting rules change

[decyjphr]

Problem

When a suborg.yml file changes its targeting rules (suborgrepos, suborgteams, or suborgproperties), repos that no longer match the updated targeting were not having their suborg-applied settings (e.g. rulesets) removed.

This happens because getSubOrgConfigs() only resolves the new targeting, and updateRepos() skips repos not in the current targeting set (subOrgConfigMap check at line 1241). Repos that used to match but no longer match are never processed, so their orphaned rulesets persist.

Note: The case where a repo property changes (causing the repo to drop out of targeting) was already working via the re-evaluation logic. This fix addresses the other case -- when the suborg.yml targeting rules themselves change.

Approach

Load the previous version of changed suborg config files from the base ref, resolve which repos were previously targeted, compare with current targeting, and process removed repos so diffable.sync() detects and removes orphaned settings.

Key design decisions:

• For push events, payload.before (previous commit SHA) serves as the base ref
• For PR/NOP events, pull_request.base.ref is already passed as baseRef
• Previous targeting is resolved using the same mechanisms (API calls for teams/properties, direct matching for repo patterns)
• Removed repos are processed before the suborg iteration loop, when subOrgConfigMap is not yet set, so the existing skip logic naturally allows them through
• Removed repos are added to changedRepoNames so NOP filtering correctly includes their results in PR checks

Changes

• index.js: Pass payload.after/payload.before as ref/baseRef to syncSelectedSettings in the push handler
• lib/settings.js: Add getReposRemovedFromSubOrgTargeting() to compare old vs new targeting and return dropped repos; add loadYamlFromRef() helper for cache-free ref-specific file loading; update syncSelectedRepos to accept baseRef and process removed repos
• test/unit/lib/settings.test.js: 7 new tests covering suborgrepos, suborgteams, suborgproperties removal, deduplication, and error handling

[Copilot]

Pull request overview

This PR aims to ensure that when a suborg config file changes its targeting rules (suborgrepos, suborgteams, suborgproperties), repositories that no longer match are still processed so previously suborg-applied settings (e.g., rulesets) are removed.

Changes:

• Pass push-event after/before SHAs through the sync path so the previous version of a changed suborg config can be loaded.
• Add logic to load prior suborg configs from baseRef, compare previous vs current targeting, and process repos dropped from targeting.
• Add unit tests for dropped-repo detection across suborgrepos, suborgteams, suborgproperties, plus deduping and 404 handling.

Show a summary per file

File	Description
index.js	Threads push SHAs (payload.after/payload.before) into the selected-settings sync path.
lib/settings.js	Introduces previous-targeting comparison (getReposRemovedFromSubOrgTargeting) and a ref-specific YAML loader (loadYamlFromRef); processes removed repos during selected sync.
test/unit/lib/settings.test.js	Adds unit coverage for removed-repo detection scenarios and error handling.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 3/3 changed files
• Comments generated: 2