[github-actions]

Overview

Follow-up sync for v1.0.1 (published 2026-10-27). Earlier syncs (#72907, #73154, #73470, #74248, #74457) covered changes through 2026-11-02, so this pass focuses on doc and code changes merged after #74248. It fixes four places where the instructions disagreed with the code, adds the newly shipped OTLP runtime controls, and removes repeated guidance. The total line count is unchanged (+27/−27).

Accuracy fixes

Area	Source	Fix
Network defaults	#74364 + pkg/workflow/data/ecosystem_domains.json	workflow-constraints.md said defaults covers "core GitHub/Copilot/registry endpoints". It now covers only CA, JSON-schema, and stock Ubuntu hosts. network.md rows for defaults and linux-distros updated; third-party apt sources (PPA, packagecloud, snapcraft, Microsoft/Google repos) now need linux-distros.
Prompt expressions	#74689	context.md claimed {{#if}} inside fenced blocks is always verbatim. Malformed active conditions now fail compilation, and only invalid implicit conditions in code regions stay literal. workflow-editing.md now says adding or changing expressions or conditions in the body requires recompilation.
features.copilot-requests	pkg/cli/codemod_copilot_requests_feature.go	Was listed as a current feature flag; now marked deprecated, with a pointer to permissions.copilot-requests: write (migrated by gh aw fix).
copilot-requests: write scope	#74242, permissions schema enum	Said "Copilot coding agent"; it is for Copilot inference (default engine, or Claude/Codex/pi with copilot/ models). Added the Claude-on-Copilot compile warning and the copilot-requests: none opt-out.
OTLP config	observability.otlp schema; #74594, #74599, #74729	Documented the object/array endpoint forms, map-form headers (string form deprecated), if-missing, and attributes. Added runtime controls: OTEL_EXPORTER_OTLP_PROTOCOL (http/protobuf), per-signal overrides, GH_AW_OTLP_LOGS_ENABLED, GH_AW_OTLP_LOGS_MAX_BYTES, and default_otlp_protocol. Examples switched to the non-deprecated map form.
PR safe outputs	#74542, #74361	fallback-to-issue issues are labeled pull-request-fallback and expire with the PR (default 7 days). Added the shared checkout-credential precedence for same-repo create-pull-request + push-to-pull-request-branch.

Duplication removed

• copilot-requests recommendation: create-agentic-workflow.md and update-agentic-workflow.md now point to the single canonical rule in syntax-core.md instead of restating it, wrongly scoped, in each.
• Recompile rules in update-agentic-workflow.md: dropped the "Common Update Categories" section (it repeated the pointer to workflow-editing.md) and two Validation Flow bullets that repeated the compile rule and the Final Message Rules.
• workflow-editing.md: merged two "body changes take effect on next run" sentences and two "always compile after any change" rules into one each.

Before/after line counts (edited files)

File	Before	After	Target
syntax-agentic.md	345	350	< 400 ✅
syntax-core.md	175	175	< 400 ✅
context.md	180	181	< 400 ✅
network.md	217	217	< 400 ✅
workflow-constraints.md	87	87	< 400 ✅
safe-outputs-content.md	389	389	< 400 ✅ (folded into an existing sentence, no new lines)
safe-outputs-management.md	324	326	< 400 ✅
create-agentic-workflow.md	380	380	< 400 ✅
update-agentic-workflow.md	142	136	< 400 ✅
workflow-editing.md	89	86	< 400 ✅
token-optimization-observability.md	57	58	< 400 ✅

Audit details

• Release: v1.0.1, published 2026-10-27T16:40:10Z. The checkout is shallow (one commit), so the history and diff pass used native GitHub commit reads; no fetch was performed.
• Docs commits reviewed (since last sync): Detect OTLP partial rejection without retrying accepted records #74767, fix(otel): preserve token accounting missingness #74766, Fail compilation on invalid prompt expressions and restore substitution #74689, Fix signal-aware OTLP protobuf logs and Azure log endpoints #74729, Persist the resolved App token for safe-output PR pushes #74361, fix: remove redundant nesting from agent session summaries #74671, Instrument work queue state and health with OpenTelemetry #74634, Add dependency-free OTLP protobuf support for Azure Monitor #74594, Add opt-in OTLP session logs with bounded priority compaction #74599, Bump gh-aw-firewall to v0.29.6 and gh-aw-mcpg to v0.5.2 #74389, docs: reorder enterprise section and rename centralized campaigns #74556, Restrict implicit network defaults to documented infrastructure #74364, Align protected-file fallback issues with PR expiration #74542, Fix false dependency cycles for custom jobs after repo-memory push #74366, [docs] Update glossary - daily scan #74477, Report failures when activation stops before agent startup #74365, Clarify recurring safe-output and setup-uv authoring errors #74367, Correct safe-output code-push failure documentation #74358, [docs] docs: unbloat reference/faq.md #74336, Fix runtime cache-memory cold-start reporting guidance #74261, Fix daily credit accounting for advisory Decisions failures #74317, Use github.token for Claude-on-Copilot workflows and warn when copilot-requests: write is missing #74242. Only Fail compilation on invalid prompt expressions and restore substitution #74689 was inspected at commit level; the rest were checked against the current tree.
• Size audit: every .github/aw/*.md file is ≤ 400 lines. cli-commands.md sits at exactly 400 and was not touched; extract a sub-file before adding anything to it.
• Safe-output accuracy: every handler key in safe_outputs_config_types.go appears in the instruction files. Experimental labels match the code (merge-pull-request is still experimental). Note that pkg/workflow/safe_outputs_config.go has been split into safe_outputs_config_*.go; the janitor's required-review list should be updated.
• Not edited: otel.md still describes JSON-only trace export. It is maintained by the dedicated weekly OTel reference workflow (Add weekly agent-facing OpenTelemetry reference workflow #74598), so it was left for that workflow's next run.
• Steering issue [WIP] Instructions Janitor: work in progress #74800: no steer comments.

Next actions

• Update the janitor's accuracy-audit file list: safe_outputs_config.go → safe_outputs_config_types.go.
• Let the OTel reference workflow pick up protobuf and session-log export in otel.md.

References: §41799817537

🤖 Generated with [Claude Code]((claude.com/redacted)

Generated by 🧹 Instructions Janitor · claude · routed: opus55 xhigh · ~330 AIC · ⌖ ~2 AIC · ⊞ 3.2K · ◷

• expires on Nov 6, 2026, 12:40 AM UTC-08:00

[Copilot]

🟡 Changes recommended

The documentation contains unresolved inaccuracies about OTLP environment mapping, exporter behavior, attribute interpolation, and credential precedence that could lead users to configure workflows incorrectly.

4 open issues

• Document checkout-scoped App credential precedence · New
• if-missing also disables unauthenticated OTLP exporters · New
• OTLP attributes do not interpolate span expressions · New
• Per-signal overrides require workflow env variables · New

What changed in this PR

This documentation-only PR syncs gh-aw’s agent-facing instructions with recent compiler and runtime changes following v1.0.1.

Changes:

• Updates network defaults, prompt-expression rules, and Copilot authentication guidance.
• Expands OTLP configuration and safe-output behavior references.
• Consolidates repeated workflow-editing and recompilation guidance.

File	Description
.github/​aw/​workflow-editing.md	Clarifies expression-related recompilation and removes repetition.
.github/​aw/​workflow-constraints.md	Corrects the scope of default network access.
.github/​aw/​update-agentic-workflow.md	Consolidates update rules and Copilot guidance.
.github/​aw/​token-optimization-observability.md	Uses map-form OTLP headers and links runtime controls.
.github/​aw/​syntax-core.md	Clarifies Copilot inference permissions and opt-out.
.github/​aw/​syntax-agentic.md	Expands OTLP options and marks the legacy Copilot flag deprecated.
.github/​aw/​safe-outputs-management.md	Documents shared PR checkout credential precedence.
.github/​aw/​safe-outputs-content.md	Documents fallback-issue labels and expiration.
.github/​aw/​network.md	Updates default and Linux distribution domain descriptions.
.github/​aw/​create-agentic-workflow.md	Links canonical Copilot inference guidance.
.github/​aw/​context.md	Clarifies malformed conditions and code-region handling.

_{Review effort: Balanced (auto)}

[github-actions]

🎉 This pull request is included in a new release.

Release: v1.2.0