feat: support workspace exclusion filtering in update workflow (#117)

* feat: support workspace exclusion filtering in update workflow

Add exclude-workspaces input to the reusable update-plugins-repo-refs
workflow. After workspace grouping, any workspace name matching an
exclude pattern is removed before the matrix is built, ensuring excluded
workspaces never reach the update job.

Assisted-by: Claude Code
Signed-off-by: Tomas Kral <tkral@redhat.com>

* refactor: replace shell loop with jq with_entries for workspace exclusion

Use a single jq invocation instead of nested shell loops that mutate
the workspaces map while iterating over its keys.

---------

Signed-off-by: Tomas Kral <tkral@redhat.com>

Author: kadel

.github/workflows/update-plugins-repo-refs.yaml

@@ -41,7 +41,12 @@ on:
         type: string
         required: false
         default: ""
-        
+
+      exclude-workspaces:
+        type: string
+        required: false
+        default: ""
+
 jobs:
 
   prepare:
@@ -353,6 +358,8 @@ jobs:
       - name: Gather Workspaces
         id: gather-workspaces
         shell: bash
+        env:
+          INPUT_EXCLUDE_WORKSPACES: ${{ inputs.exclude-workspaces }}
         run: |
           if [[ "${{ inputs.debug }}" == "true" ]]
           then
@@ -443,6 +450,19 @@ jobs:
             ) | add
           ')
 
+          # Filter out excluded workspaces
+
+          if [[ -n "${INPUT_EXCLUDE_WORKSPACES}" ]]; then
+            workspaces=$(echo "$workspaces" | jq --arg exclude "${INPUT_EXCLUDE_WORKSPACES}" '
+              with_entries(
+                select(
+                  .value.workspace as $name |
+                  ($exclude | split(" ") | any($name | test(.))) | not
+                )
+              ) | if length == 0 then null else . end
+            ')
+          fi
+
           # Finally, prepare outputs for the next steps.
 
           if [[ "$workspaces" == "null" ]]