zuul/tests/fixtures/config/tenant-parser/groups2.yaml

- tenant:
    name: tenant-one
    source:
      gerrit:
        config-projects:
          - common-config
        untrusted-projects:
          - exclude: project
            projects:
              - org/project1
              - org/project2:
                  exclude: job
              - org/project3:
                  exclude: job