feat: add option to exclude private repos from indexing (#1632)

* feat: add option to exclude private GitHub repos from indexing

fixes #1631

* Use repo.private with internal exemption for exclude.private

Address cubic review: visibility can be null on GitHub AE and older
GHES. Use repo.private as the primary filter and exempt internal
repos via repo.visibility !== 'internal'.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Add regression test for missing visibility field

Address coderabbit review: cover the case where a private repo has
no visibility field. The repo must still be excluded when
exclude.private is true.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Use second-person wording in exclude.private description

Address coderabbit review: change description to "You can exclude
private repositories from syncing." Regenerate all derived schema
and documentation files.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* nit

* changelog

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Brendan Kellam <brendan@sourcebot.dev>

Author: 3 people

CHANGELOG.md

@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+- Added `exclude.private` option to github connection config. [#1632](https://github.com/sourcebot-dev/sourcebot/pull/1632)
+
 ### Fixed
 - Silenced a false-positive `MaxListenersExceededWarning` logged on every request proxied through an external rewrite. [#1697](https://github.com/sourcebot-dev/sourcebot/pull/1697)
 - Upgraded `brace-expansion` to `^1.1.21`, `^2.1.7`, and `^5.0.12`. [#1700](https://github.com/sourcebot-dev/sourcebot/pull/1700)

docs/snippets/schemas/v3/connection.schema.mdx

@@ -125,6 +125,11 @@
               "default": false,
               "description": "Exclude archived repositories from syncing."
             },
+            "private": {
+              "type": "boolean",
+              "default": false,
+              "description": "Exclude private repositories from syncing. Internal repositories are not affected."
+            },
             "repos": {
               "type": "array",
               "items": {

docs/snippets/schemas/v3/github.schema.mdx

@@ -121,6 +121,11 @@
           "default": false,
           "description": "Exclude archived repositories from syncing."
         },
+        "private": {
+          "type": "boolean",
+          "default": false,
+          "description": "Exclude private repositories from syncing. Internal repositories are not affected."
+        },
         "repos": {
           "type": "array",
           "items": {

docs/snippets/schemas/v3/index.schema.mdx

@@ -622,6 +622,11 @@
                       "default": false,
                       "description": "Exclude archived repositories from syncing."
                     },
+                    "private": {
+                      "type": "boolean",
+                      "default": false,
+                      "description": "Exclude private repositories from syncing. Internal repositories are not affected."
+                    },
                     "repos": {
                       "type": "array",
                       "items": {

packages/backend/src/github.test.ts

@@ -214,6 +214,40 @@ test('shouldExcludeRepo handles archived repos correctly', () => {
     expect(shouldExcludeRepo({ repo, exclude: { archived: false } })).toBe(false);
 });
 
+test('shouldExcludeRepo handles private repos correctly', () => {
+    const privateRepo = {
+        full_name: 'test/private-repo',
+        clone_url: 'https://github.com/test/private-repo.git',
+        private: true,
+        visibility: 'private',
+    } as OctokitRepository;
+
+    expect(shouldExcludeRepo({ repo: privateRepo })).toBe(false);
+    expect(shouldExcludeRepo({ repo: privateRepo, exclude: { private: true } })).toBe(true);
+    expect(shouldExcludeRepo({ repo: privateRepo, exclude: { private: false } })).toBe(false);
+});
+
+test('shouldExcludeRepo does not exclude internal repos when exclude.private is true', () => {
+    const internalRepo = {
+        full_name: 'test/internal-repo',
+        clone_url: 'https://github.com/test/internal-repo.git',
+        private: true,
+        visibility: 'internal',
+    } as OctokitRepository;
+
+    expect(shouldExcludeRepo({ repo: internalRepo, exclude: { private: true } })).toBe(false);
+});
+
+test('shouldExcludeRepo excludes private repos with missing visibility when exclude.private is true', () => {
+    const repo = {
+        full_name: 'test/private-no-visibility',
+        clone_url: 'https://github.com/test/private-no-visibility.git',
+        private: true,
+    } as OctokitRepository;
+
+    expect(shouldExcludeRepo({ repo, exclude: { private: true } })).toBe(true);
+});
+
 test('shouldExcludeRepo handles include.topics correctly', () => {
     const repo = {
         full_name: 'test/repo',

packages/backend/src/github.ts

@@ -77,6 +77,7 @@ export type OctokitRepository = {
     full_name: string,
     fork: boolean,
     private: boolean,
+    visibility?: string,
     html_url: string,
     clone_url?: string,
     stargazers_count?: number,
@@ -507,6 +508,11 @@ export const shouldExcludeRepo = ({
             return true;
         }
 
+        if (!!exclude?.private && repo.private && repo.visibility !== 'internal') {
+            reason = `\`exclude.private\` is true`;
+            return true;
+        }
+
         if (exclude?.repos) {
             if (micromatch.isMatch(repoName, exclude.repos)) {
                 reason = `\`exclude.repos\` contains ${repoName}`;

packages/schemas/src/v3/connection.schema.ts

@@ -124,6 +124,11 @@ const schema = {
               "default": false,
               "description": "Exclude archived repositories from syncing."
             },
+            "private": {
+              "type": "boolean",
+              "default": false,
+              "description": "Exclude private repositories from syncing. Internal repositories are not affected."
+            },
             "repos": {
               "type": "array",
               "items": {

packages/schemas/src/v3/connection.type.ts

@@ -61,6 +61,10 @@ export interface GithubConnectionConfig {
      * Exclude archived repositories from syncing.
      */
     archived?: boolean;
+    /**
+     * Exclude private repositories from syncing. Internal repositories are not affected.
+     */
+    private?: boolean;
     /**
      * List of individual repositories to exclude from syncing. Glob patterns are supported.
      */

packages/schemas/src/v3/github.schema.ts

@@ -120,6 +120,11 @@ const schema = {
           "default": false,
           "description": "Exclude archived repositories from syncing."
         },
+        "private": {
+          "type": "boolean",
+          "default": false,
+          "description": "Exclude private repositories from syncing. Internal repositories are not affected."
+        },
         "repos": {
           "type": "array",
           "items": {

packages/schemas/src/v3/github.type.ts

@@ -52,6 +52,10 @@ export interface GithubConnectionConfig {
      * Exclude archived repositories from syncing.
      */
     archived?: boolean;
+    /**
+     * Exclude private repositories from syncing. Internal repositories are not affected.
+     */
+    private?: boolean;
     /**
      * List of individual repositories to exclude from syncing. Glob patterns are supported.
      */