[docs] Update documentation for features from 2026-02-25

[github-actions]

Documentation Updates - 2026-02-25

This PR updates the documentation based on features merged in the last 24 hours.

Features Documented

• gh aw validate command (from feat: add gh aw validate command #18191)
• threat-detection: false import precedence behaviour (from fix: imported safe-output fragments no longer override explicit threat-detection: false #18231)

Changes Made

• Updated docs/src/content/docs/setup/cli.md to add a full validate command section under Building (after compile). PR feat: add gh aw validate command #18191 added the command and updated the compilation-process.md reference table, but the primary CLI commands page was missing the entry.
• Updated docs/src/content/docs/reference/threat-detection.md to add a NOTE callout clarifying that an explicit threat-detection: false in a workflow takes precedence over imported shared fragments — documenting the behaviour fixed in fix: imported safe-output fragments no longer override explicit threat-detection: false #18231.

Merged PRs Referenced

• feat: add gh aw validate command #18191 — feat: add gh aw validate command
• fix: imported safe-output fragments no longer override explicit threat-detection: false #18231 — fix: imported safe-output fragments no longer override explicit threat-detection: false
• Document mandatory sudo requirement for self-hosted agentic workflows #18210 — Document mandatory sudo requirement for self-hosted agentic workflows (already documented in the PR itself)
• docs: update init/upgrade/fix help text to remove stale .github/aw/ prompt file references #18218 — docs: update init/upgrade/fix help text to remove stale .github/aw/ prompt file references (internal help text; no external docs gap)
• fix(code-simplifier): allow Go module proxy domains via go network preset #18214 — fix(code-simplifier): allow Go module proxy domains via go network preset (go ecosystem identifier already documented in reference/network.md)

Notes

No other merged PRs from the last 24 hours required external documentation updates. Internal fixes, test improvements, and infrastructure changes (#18253, #18234, #18224, #18216, #18215, #18208, #18206, #18205, #18197, #18194) were either non-user-facing or already accompanied by inline documentation in their respective PRs.

Generated by Daily Documentation Updater

• expires on Feb 26, 2026, 4:25 AM UTC

[Copilot]

Pull request overview

This PR updates the documentation to reflect two features that were merged in the last 24 hours: the new gh aw validate command (from #18191) and the clarified import precedence behavior for threat-detection: false (from #18231).

Changes:

• Added complete validate command section to the CLI reference documentation
• Added a NOTE callout clarifying that explicit threat-detection: false takes precedence over imported fragments

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
docs/src/content/docs/setup/cli.md	Added validate command section under Building, documenting usage, options, and equivalence to compile --validate --no-emit --zizmor --actionlint --poutine
docs/src/content/docs/reference/threat-detection.md	Added NOTE callout explaining that explicit threat-detection: false in a workflow takes precedence over imported fragments that configure safe outputs

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The phrase "always-on defaults and cannot be disabled" is slightly contradictory - "defaults" typically implies configurability, but "cannot be disabled" states the opposite. Consider rephrasing to "are always enabled and cannot be disabled" or "are enforced and cannot be disabled" for clearer communication.

Suggested change

	All linters (`zizmor`, `actionlint`, `poutine`), `--validate`, and `--no-emit` are always-on defaults and cannot be disabled. Accepts the same workflow ID format as `compile`.
	All linters (`zizmor`, `actionlint`, `poutine`), `--validate`, and `--no-emit` are always enabled and cannot be disabled. Accepts the same workflow ID format as `compile`.