Merge remote-tracking branch 'origin/main' into copilot/lint-monster-targeted-cleanup

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Author: Copilot

.github/aw/create-agentic-workflow.md

@@ -86,31 +86,13 @@ Use [workflow-patterns.md](workflow-patterns.md) and [triggers.md](triggers.md)
 
 ### 2a. Reporting and digest compact guidance
 
-For recurring reports, audits, and stakeholder digests:
+For recurring reports, audits, and stakeholder digests, set these create-specific defaults:
 
 - default to `create-issue`; use `create-discussion` only when the requester explicitly wants threaded discussion
 - use `add-comment` only when updating an existing issue or pull request instead of creating a new report destination
-- define the report window explicitly (for example `last 7 full days ending at workflow start (UTC)` or `since previous successful run`)
-- define the grouping dimensions explicitly (for example by team, service, owner, severity, status, or repository)
 - add `workflow_dispatch` when manual reruns, backfills, or preview runs should be possible
-- require `noop` when the selected window has no qualifying updates
 
-**Duplicate-suppression checklist for recurring reports and audits:**
-
-- [ ] Define a stable deduplication key (for example `workflow + window-date` or `scope + YYYY-W01` using ISO week notation)
-- [ ] Search for an existing open issue with that key before creating a new one (for example by title prefix or label)
-- [ ] If a matching open issue exists, update it with `add-comment` instead of creating a duplicate
-- [ ] If the window has zero qualifying updates, call `noop` — never create an empty or placeholder report
-- [ ] Escalate with a new issue only when no open issue covers the same scope and window
-
-**Fallback when customer-impact metadata is incomplete:**
-
-When the digest depends on labels, metadata, or classification fields (for example customer-impact labels, priority tiers, or team assignments) that are absent or inconsistent:
-
-- summarize what data *was* available and note which fields are missing
-- group by the next-best available dimension (for example repository, author, date, or milestone)
-- use an explicit "Unclassified" bucket for items without required metadata — do not invent or assume classifications
-- call `noop` only when the reporting window itself has zero events; missing metadata is not a reason to skip the digest
+Follow [triggers.md](triggers.md) for the report window, grouping dimensions, deduplication key, and empty-window `noop` rule, and [workflow-patterns.md](workflow-patterns.md) for the digest/incident skeletons. When the digest depends on missing or inconsistent metadata, group by the next-best available dimension, use an explicit "Unclassified" bucket, and never invent classifications — call `noop` only when the window itself has zero events.
 
 ### 2aa. Persona-oriented scenario quick map
 

.github/aw/reuse.md

@@ -43,12 +43,9 @@ imports:
   - path: shared/tool-setup.md
     with:
       environment: staging
-    env:
-      MY_OVERRIDE: "value"   # env vars for the import's context
-    checkout: main            # ref to check out for this import
 ```
 
-`with:` values are accessed inside the shared file as `${{ github.aw.import-inputs.<name> }}`.
+`path`/`uses` and `with`/`inputs` are the only valid keys on an import entry. To supply environment variables or a checkout ref, set top-level `env:`/`checkout:` frontmatter inside the imported file itself; those are merged into the importing workflow (see [syntax-tools-imports.md](syntax-tools-imports.md)). `with:` values are accessed inside the shared file as `${{ github.aw.import-inputs.<name> }}`.
 
 ---
 

.github/aw/safe-outputs-management.md

@@ -137,7 +137,7 @@ description: Safe-output reference for update, label, milestone, project, releas
   safe-outputs:
     assign-milestone:
       allowed: [v1.0, v2.0]           # Optional: restrict to specific milestone titles
-      auto-create: true               # Optional: auto-create milestones from the allowed list if missing (default: false)
+      auto_create: true               # Optional: auto-create milestones from the allowed list if missing (default: false)
       max: 1                          # Optional: max assignments (default: 1)
       target-repo: "owner/repo"       # Optional: cross-repository
   ```

.github/aw/safe-outputs-runtime.md

@@ -81,6 +81,9 @@ description: Safe-output reference for runtime defaults, custom jobs, scripts, a
   ```
 
   Useful when you need additional permissions or want to perform actions across repositories.
+- `urls:` - URL sanitization policy for safe output content (string)
+  - `allowed-only` (default) - sanitize all non-allowed URLs everywhere
+  - `allowed-or-code-region` - preserve URLs inside fenced and inline code regions while sanitizing prose
 - `allowed-domains:` - Allowed domains for URLs in safe output content (array)
   - URLs from unlisted domains are replaced with `(redacted)`
   - GitHub domains are always included by default

.github/aw/syntax.md

@@ -11,6 +11,8 @@ Use the smallest relevant reference instead of loading one large schema file.
 | Core GitHub Actions fields (`on`, `permissions`, `runs-on`, `steps`, `env`, `secrets`) | [syntax-core.md](syntax-core.md) |
 | Agentic workflow specific fields (`strict`, `bots`, `labels`, metadata, engine-specific fields) | [syntax-agentic.md](syntax-agentic.md) |
 | Cache configuration, tools, imports, and permission patterns | [syntax-tools-imports.md](syntax-tools-imports.md) |
+| `skills` field | [skills.md](skills.md) |
+| `lsp` field | [lsp.md](lsp.md) |
 
 ## Usage Guidance
 

.github/workflows/daily-yamllint-fixer.lock.yml

@@ -37,6 +37,7 @@ safe-outputs:
     allowed-files:
       - "pkg/workflow/**/*.go"
       - "pkg/workflow/assets/**"
+      - "pkg/workflow/testdata/**"
   noop:
 timeout-minutes: 30
 strict: true