[instructions] Sync instruction files with recent safe-output and CLI changes

[github-actions]

Instructions janitor pass

Instructions were already synced to v0.88.7 by #60231 on 2026-09-11. This pass covers commits landed after that sync, up to run 34748033754.

Size audit: all .github/aw/*.md files remain under their target limits; no split needed.

Duplication audit: no new duplication introduced; the target: enforcement note was added once to the shared-rules section of safe-outputs.md rather than repeated across every handler that uses target:.

Changes

File	Before -> After	Fix
safe-outputs.md	21 -> 22	Documented that target: "triggering"/fixed-number is enforced, not just validated -- model-supplied issue/PR numbers (incl. temporary-id refs) are ignored unless target: "*". Confirmed against update_handler_factory.cjs from #60362.
safe-outputs-runtime.md	308 -> 310	Added the global body-footer: field (additive with per-handler body-footer:), added in #60275. Confirmed against safe_outputs_config_types.go.
cli-commands.md	329 -> 330	Added gh aw update <package-url-or-name> form from #60452 (package-aware update targets).

Commits reviewed (since 2026-09-11T12:35:55Z sync)

Full diff reviewed: #60536, #60275, #60267, #60362, #60452.
Skimmed for relevance (docs/.github/aw path touched, no instruction change needed): #60531, #60532, #60424, #60346, #60350, #60361, #60348, #60359, #60323, #60310, #60289, #60217.

• Validate external safe-output secrets before activation #60267 (validate external safe-output secrets before activation) -- fails faster at activation time; no new user-facing field, required secrets (JIRA_API_TOKEN, LINEAR_API_KEY, AZURE_DEVOPS_EXT_PAT) were already documented. No change needed.
• Allow aw.yml packages to install shared JavaScript modules #60536 (aw.yml packages can install shared JS modules) -- real gap, but the whole aw.yml package-manifest system (as opposed to single-file gh aw add shared components) isn't covered anywhere in .github/aw/*.md today. Documenting one resource type in isolation would be more confusing than helpful; flagging as a follow-up rather than a partial patch.

No steering-issue comments were available to incorporate -- the run's steering issue number was unset in this invocation's context.

---

Note

This was originally intended as a pull request, but PR creation failed. The changes have been pushed to the branch instructions-sync-v0.88.7-followup-d00e033aafb6ed8e.

Original error: ERR_API: [2026-09-13T08:47:15.806Z] create pull request in github/gh-aw failed (attempt 1)

Original error: Server Error
Retryable: false
Suggestion: This error cannot be resolved by retrying. Please check the error details and fix the underlying issue.

To create the pull request manually:

gh pr create --title "[instructions] Sync instruction files with recent safe-output and CLI changes" --base main --head instructions-sync-v0.88.7-followup-d00e033aafb6ed8e --repo github/gh-aw

Show patch preview (37 of 60 lines)

From e781b39739abd44a750de6d866097f770375428b Mon Sep 17 00:00:00 2001
X-GH-AW-Base-Commit: b68dba0ae6b4422e4a520ce66e30b88c8313713b
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Sun, 13 Sep 2026 08:42:23 +0000
Subject: [PATCH] [instructions] Sync instruction files with recent safe-output
 and CLI changes

Fixes three accuracy gaps found since the last instructions sync (v0.88.7, PR #60231):
- target: enforcement (#60362) was undocumented: when target is "triggering" or a fixed
  number, model-supplied issue/PR numbers are ignored, not merely validated.
- The new global body-footer: field (#60275, additive with per-handler body-footer) was
  missing from safe-outputs-runtime.md.
- gh aw update now accepts a package URL/name to update all workflows from that package
  (#60452); cli-commands.md only showed single-workflow and bulk update forms.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .github/aw/cli-commands.md         | 1 +
 .github/aw/safe-outputs-runtime.md | 2 ++
 .github/aw/safe-outputs.md         | 1 +
 3 files changed, 4 insertions(+)

diff --git a/.github/aw/cli-commands.md b/.github/aw/cli-commands.md
index 0e11edc..cc1b9ed 100644
--- a/.github/aw/cli-commands.md
+++ b/.github/aw/cli-commands.md
@@ -223,6 +223,7 @@ Update imported shared workflow components.
 ```bash
 gh aw update                                # Update all workflows from source
 gh aw update <workflow-name>                # Update a specific workflow
+gh aw update <package-url-or-name>          # Update all workflows installed from a package
 gh aw update --major                        # Allow major version updates
 gh aw update --create-pull-request          # Update and open a PR (alias: --pr)
 gh aw update --repo owner/repo              # Update workflows in another repository (isolated shallow checkout)
diff --git a/.github/aw/safe-outputs-runtime.md b/.github/aw/safe-outputs-runtime.md
index 4467912..4ee535d 100644
--- a/.github/aw
... (truncated)

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 🧹 Instructions Janitor · claude · sonnet50 · 417.2 AIC · ⌖ 32.8 AIC · ⊞ 7.2K · ◷

• expires on Sep 15, 2026, 12:46 AM UTC-08:00