[instructions] Sync github-agentic-workflows.md with v0.68.3

[github-actions]

Instructions Update - Synchronized with v0.68.3

This PR updates github-agentic-workflows.md based on code/schema audit since v0.68.3 (last sync was v0.68.1). No doc files changed since the release; changes are driven by the code-vs-instructions comparison.

Changes Made

• pre-steps: field — Added to the Core GitHub Actions Fields section (between name: and steps:). This top-level field runs custom steps before checkout and is already listed in the imports merge table but had no dedicated definition.
• run-install-scripts: field — Added after runtimes: in the Agentic Workflow Specific Fields section. Security opt-in (default: false) that allows npm install scripts to run; emits a supply chain security warning at compile time.
• on.stale-check: sub-field — Added to the on: sub-fields section. Disables the frontmatter hash check in the activation job; needed for cross-repo org ruleset deployments.

Documentation Commits Reviewed

• f42052b Prevent false CLI Version Checker failures when safe outputs were already produced (Prevent false CLI Version Checker failures when safe outputs were already produced #26570) — only changed log_parser_bootstrap.cjs, no doc impact

Safe-Outputs Code Audit

Compared SafeOutputsConfig struct fields in pkg/workflow/compiler_types.go and extractSafeOutputsConfig in pkg/workflow/safe_outputs_config.go against the instructions. All safe-output operations, configuration fields, and behavior notes are accurately reflected. No gaps found in safe-outputs coverage.

Validation

• Followed prompting best practices (imperative mood, minimal examples)
• Maintained technical tone and brevity
• Updated only necessary sections
• Verified accuracy against current codebase (JSON schema + Go structs)
• Removed outdated or redundant content (none needed)

Generated by Instructions Janitor · ● 632.5K · ◷

• expires on Apr 18, 2026, 11:05 AM UTC

[github-actions]

Hey @github-actions[bot] 👋 — thanks for keeping the instructions file in sync with the v0.68.3 codebase! The additions for pre-steps:, run-install-scripts:, and on.stale-check: are clearly documented and well-described.

One small note: no test files were changed in this PR. For a pure documentation sync like this one, test coverage isn't typically applicable — but if any of the newly-documented fields (pre-steps:, run-install-scripts:, on.stale-check:) involve logic that isn't yet covered by tests in the codebase, it may be worth flagging for a follow-up.

If you'd like a hand addressing any gaps, you can assign this prompt to your coding agent:

Review the newly documented fields pre-steps:, run-install-scripts:, and on.stale-check: in .github/aw/github-agentic-workflows.md.
For each field, check whether the corresponding implementation in pkg/workflow/ has adequate test coverage.
If any field lacks tests, add unit tests covering:
1. The default behavior (e.g., run-install-scripts: false appends --ignore-scripts).
2. The opt-in/override behavior (e.g., run-install-scripts: true omits --ignore-scripts and emits a compile-time warning).
3. Any strict-mode error paths.

Generated by Contribution Check · ● 1.3M · ◷