Clarify runtime-import path validation examples in templating docs

[Copilot]

The runtime-import path validation documentation showed two relative traversal examples (different depths) as invalid paths, obscuring that absolute paths are also rejected.

Changes

Updated docs/src/content/docs/reference/templating.md:

• Path Validation section: Changed second invalid example from ../../etc/passwd (relative traversal) to /etc/passwd (absolute path)
• Error Handling section: Split single example into two distinct cases with labels:
  • Relative traversal: ../src/main.go
  • Absolute path: /etc/passwd

The examples now map directly to the two validation conditions in runtime_import.cjs:

if (relativePath.startsWith("..") || path.isAbsolute(relativePath)) {
  throw new Error(`Security: Path ${filepathOrUrl} must be within .github folder`);
}

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[deep-report] Clarify runtime-import path validation examples in templating docs</issue_title>
<issue_description>### Description
User Experience Analysis recommends improving docs/src/content/docs/reference/templating.md to distinguish invalid runtime-import paths (relative traversal vs absolute paths) rather than repeating identical error examples. Update the examples to show distinct failure cases.

Expected Impact

Reduces user confusion and improves clarity of security constraints for runtime imports.

Suggested Agent

Documentation Agent

Estimated Effort

Fast (< 30 min)

Data Source

DeepReport Intelligence Briefing - 2026-02-16 (User Experience Analysis, discussion #16093)

Generated by DeepReport - Intelligence Gathering Agent

• expires on Feb 18, 2026, 3:28 PM UTC

Comments on the Issue (you are @copilot in this section)

• Fixes [deep-report] Clarify runtime-import path validation examples in templating docs #16130

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Copilot]

Pull request overview

This PR clarifies the runtime-import path validation documentation by providing distinct examples for the two types of invalid paths that are rejected by the security validation logic. Previously, both invalid examples showed relative path traversal at different depths, obscuring the fact that absolute paths are also rejected.

Changes:

• Updated Path Validation section to show one relative traversal example (../src/config.go) and one absolute path example (/etc/passwd)
• Enhanced Error Handling section by splitting a single example into two labeled cases with distinct error scenarios
• Aligned examples with the two validation conditions in runtime_import.cjs: relativePath.startsWith("..") OR path.isAbsolute(relativePath)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.