Skip to content

[docs] Update documentation for features from 2026-03-01 #18982

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pelikhan merged 2 commits into from
Mar 1, 2026
+39 −2
Merged

[docs] Update documentation for features from 2026-03-01 #18982

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f438775
docs: document features from 2026-03-01 merged PRs
Mar 1, 2026
7aebdd2
ci: trigger CI checks
github-actions[bot] Mar 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions docs/src/content/docs/reference/github-tools.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,10 @@ tools:

## Guard Policies

:::caution[Experimental Feature]
Guard policy fields (`repos` and `min-integrity`) are experimental and may change in future releases. Using either field emits a compilation warning.
:::

Restrict which repositories and integrity levels the GitHub MCP server can access during agent execution. Guard policies apply fine-grained access control at the MCP gateway level.

```yaml wrap
Expand Down
37 changes: 35 additions & 2 deletions docs/src/content/docs/reference/safe-outputs.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -796,14 +796,20 @@ safe-outputs:

Resolves review threads on pull requests. Allows AI agents to mark review conversations as resolved after addressing the feedback. Uses the GitHub GraphQL API with the `resolveReviewThread` mutation.

Resolution is scoped to the triggering PR only — the handler validates that each thread belongs to the triggering pull request before resolving it.
By default, resolution is scoped to the triggering PR. Use `target`, `target-repo`, and `allowed-repos` for cross-repository thread resolution.

```yaml wrap
safe-outputs:
resolve-pull-request-review-thread:
max: 10 # max threads to resolve (default: 10)
max: 10 # max threads to resolve (default: 10)
target: "triggering" # "triggering" (default), "*", or number
target-repo: "owner/repo" # cross-repository
allowed-repos: ["org/repo1", "org/repo2"] # additional allowed repositories
github-token: ${{ secrets.SOME_CUSTOM_TOKEN }} # optional custom token for permissions
```

See [Cross-Repository Operations](/gh-aw/reference/cross-repository/) for documentation on `target-repo`, `allowed-repos`, and cross-repository authentication.

**Agent output format:**

```json
Expand Down Expand Up @@ -1219,6 +1225,33 @@ See [Cross-Repository Operations](/gh-aw/reference/cross-repository/) technical

## Global Configuration Options

### Workflow Call Outputs (`workflow_call`)

When a workflow uses `on: workflow_call` (or includes `workflow_call` in its triggers) and configures safe outputs, the compiler automatically injects `on.workflow_call.outputs` exposing the results of each configured safe output type. This makes gh-aw workflows composable building blocks in larger automation pipelines.

The following named outputs are exposed for each configured safe output type:
Comment on lines +1230 to +1232
Copy link

Copilot AI Mar 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The opening sentence implies on.workflow_call.outputs is injected whenever any safe outputs are configured, but the compiler only injects outputs when at least one safe-output type that produces named workflow outputs is configured (currently create-issue, create-pull-request, add-comment, push-to-pull-request-branch). Consider rewording to reflect that limitation so callers don’t expect outputs for other safe output types.

Suggested change
When a workflow uses `on: workflow_call` (or includes `workflow_call` in its triggers) and configures safe outputs, the compiler automatically injects `on.workflow_call.outputs` exposing the results of each configured safe output type. This makes gh-aw workflows composable building blocks in larger automation pipelines.
The following named outputs are exposed for each configured safe output type:
When a workflow uses `on: workflow_call` (or includes `workflow_call` in its triggers) and configures at least one safe output type that produces named workflow outputs, the compiler automatically injects `on.workflow_call.outputs` exposing the results of those supported safe output types. This makes gh-aw workflows composable building blocks in larger automation pipelines.
The following named outputs are exposed for each configured safe output type that supports `workflow_call` outputs:

Copilot uses AI. Check for mistakes.

| Safe Output Type | Output Names |
|---|---|
| `create-issue` | `created_issue_number`, `created_issue_url` |
| `create-pull-request` | `created_pr_number`, `created_pr_url` |
| `add-comment` | `comment_id`, `comment_url` |
| `push-to-pull-request-branch` | `push_commit_sha`, `push_commit_url` |

These outputs are automatically available to calling workflows without any additional frontmatter configuration. User-declared `outputs` in the frontmatter are preserved and take precedence over the auto-injected values.

**Example — calling workflow using safe-output results:**

```yaml wrap
jobs:
run-agent:
uses: ./.github/workflows/my-agent.lock.yml
follow-up:
needs: run-agent
steps:
- run: echo "Created issue ${{ needs.run-agent.outputs.created_issue_number }}"
```

### Group Reports (`group-reports:`)

Controls whether failed workflow runs are grouped under a parent "[aw] Failed runs" issue. This is opt-in and defaults to `false`.
Expand Down