[github-actions]

Warning

Threat detection engine error

Threat detection could not complete its analysis due to a tooling error. This is not a security finding.

What happened

The threat detection results could not be parsed.

Review the workflow run logs to troubleshoot the error.

Overview

This PR updates .github/aw/ instruction files for four user-facing features merged after release v1.0.1. These features are already in docs/ and main_workflow_schema.json, but the instruction files did not cover them. All instruction files are within the 400-line limit.

Changes

File	Change	Lines (before → after)
safe-outputs-content.md	Adds create-issue options deduplicate-by-labels, max-issue-artifacts, and max-issue-artifact-size, plus a short note on the artifacts runtime field that links to the docs reference	391 → 396
memory.md	Adds repo-memory GitHub App auth (github-app, github-app-read, github-app-write) for ruleset-protected memory branches	359 → 361
syntax-core.md	Adds the object form of environment: (name, url, deployment), including deployment: false	175 → 175

Audit results

• Release/change audit: The latest release is v1.0.1 (2026-10-27). The checkout is shallow, so the release tag can't be resolved locally. I listed commits through the GitHub API instead and checked the changes after the last instructions sync ([instructions] Sync instruction files with release 1.0.1 #75371).
• Size audit: Every .github/aw/*.md file is ≤ 400 lines. cli-commands.md is exactly 400 and safe-outputs-content.md is now 396. Both are near the limit and should get a dedicated sub-file before more content is added.
• Duplication audit: This PR adds no duplication. Issue-artifact detail stays in the docs reference; the instructions keep only a short summary and a link.
• Accuracy audit: I checked the new fields against pkg/parser/schemas/main_workflow_schema.json (max-issue-artifacts, max-issue-artifact-size, deduplicate-by-labels, github-app-read/github-app-write, environment.deployment).

Documentation commits reviewed

• Support issue artifacts in create-issue safe outputs #75323 Support issue artifacts in create-issue safe outputs
• Add label-scoped title deduplication for create-issue #74941 Add label-scoped title deduplication for create-issue
• Support GitHub App authentication for repo-memory #74937 Support GitHub App authentication for repo-memory
• Support deployment controls on workflow environments #74938 Support deployment controls on workflow environments
• Also checked, no instruction change needed: fix: fail closed on unresolved PR security reviews #75335 / [instructions] Sync instruction files with release 1.0.1 #75371 (already synced), Use effective runner identity and owner-only configs for safeoutputs #75443, Decouple rootless CLI installation from runner topology #75445, Support no-sudo Copilot installation in agent and detection jobs #75446 (runtime installation internals), feat(experiments): add outcome-backed metrics with adaptive maturity windows #74992 (experiments --outcome, left for a follow-up because it touches experiments.md/cli-commands.md, which are near the limit), Add artifact-backed durable workflow continuation across agents #75097 (experimental durable continuation)

Validation

• No Go or .github/workflows/*.md files changed, so I didn't run make fmt or make recompile.
• I didn't run the make agent-report-progress gates either. This workflow only allows Bash for the audit and git commands.
• The steering issue [WIP] Instructions Janitor: work in progress #75641 had no steer comments.

Next actions

• Split cli-commands.md (400 lines) and safe-outputs-content.md (396 lines) into sub-files before adding more content to either.
• Add experiments --outcome guidance from feat(experiments): add outcome-backed metrics with adaptive maturity windows #74992 after that split.

🤖 Generated with [Claude Code]((claude.com/redacted)

Generated by 🧹 Instructions Janitor · claude · routed: opus55 medium · ~101 AIC · ⌖ ~2 AIC · ⊞ 3.2K · ◷

• expires on Nov 9, 2026, 12:35 AM UTC-08:00

[Copilot]

🟡 Changes recommended

The documentation contains two active inaccuracies about label filtering and the issue-creation validation guarantee that need correction.

2 open issues

• Clarify label-only deduplication behavior · New
• Clarify post-creation artifact attachment failures · New

What changed in this PR

This pull request updates .github/aw/ instruction files to document features introduced after release v1.0.1, aligning agent guidance with the current schema and runtime behavior.

Changes:

• Documents create-issue label deduplication, artifact limits, and artifact inputs.
• Adds GitHub App authentication guidance for protected repo-memory branches.
• Documents object-form environments and deployment: false.

File	Summary	Review notes
.github/​aw/​syntax-core.md	Documents object-form environment configuration and deployment suppression.	Nits: Clarify that only name is required, while url and deployment are optional; include expression support for deployment. Update the safe-output runtime guidance, which still describes environment as string-only.
.github/​aw/​safe-outputs-content.md	Adds issue deduplication, artifact limits, and artifact usage guidance.	Nits: Clarify that label filtering works independently of title deduplication; present size formats as examples rather than an exhaustive list; narrow the pre-creation validation guarantee and mention possible post-creation partial failures.
.github/​aw/​memory.md	Adds GitHub App authentication guidance for repo-memory reads and writes.	Nit: Specify the distinct Contents permissions required by github-app-read and github-app-write.

_{Review effort: Lite (auto)}