[docs] Update documentation for features from 2026-02-19

[github-actions]

Documentation Updates - 2026-02-19

This PR updates the documentation based on features merged in the last 24 hours.

Features Documented

• blocked glob patterns for add-labels and remove-labels safe outputs (from Add blocked pattern matching for add-labels and remove-labels #16690)
• group-reports flag for opt-in failed run issue grouping (from Make parent "Failed runs" issue creation opt-in via group-reports flag #16715)
• Migration of roles and bots to on.roles and on.bots (from Move roles and bots to on.roles and on.bots #16672)
• Warning about secrets in the env section causing leakage to agent container (from Detect and block secrets in env section including sub-expressions #16722)
• Clarification that id-token: read is invalid — only write or none are valid (from fix(permissions): reject invalid id-token: read permission #16685)

Changes Made

• Updated docs/src/content/docs/reference/safe-outputs.md:

  • Added blocked field documentation for add-labels and remove-labels with glob pattern table and examples
  • Added group-reports field documentation in the Global Configuration Options section

• Updated docs/src/content/docs/reference/frontmatter.md:

  • Updated roles: section to show new on.roles: nested syntax with migration tip
  • Updated bots: section to show new on.bots: nested syntax with migration tip
  • Added warning callout about secrets in the env section being leaked to agent container

• Updated docs/src/content/docs/reference/permissions.md:

  • Clarified id-token permission only accepts write or none values; read is invalid and rejected at compile time

Merged PRs Referenced

• Add blocked pattern matching for add-labels and remove-labels #16690 - Add blocked pattern matching for add-labels and remove-labels
• Make parent "Failed runs" issue creation opt-in via group-reports flag #16715 - Make parent "Failed runs" issue creation opt-in via group-reports flag
• Move roles and bots to on.roles and on.bots #16672 - Move roles and bots to on.roles and on.bots
• Detect and block secrets in env section including sub-expressions #16722 - Detect and block secrets in env section including sub-expressions
• fix(permissions): reject invalid id-token: read permission #16685 - fix(permissions): reject invalid id-token: read permission

Notes

• PR Remove auto-compile toggle and compile button from playground #16741 (Remove auto-compile toggle from playground) and Add syntax highlighting for YAML and Markdown in playground editor #16710 (CodeMirror syntax highlighting) are playground UI changes that don't require user-facing documentation updates
• PR Remove GitHub API call from CLI initialization hot path #16699 (Remove GitHub API call from CLI hot path) and Fix validation error: remove head_commit.id from numeric context validation #16737 (Fix head_commit.id validation) are internal fixes with no user-facing documentation impact
• PR Allow ecosystem and custom domains in strict mode network configuration #16732 (Allow ecosystem/custom domains in strict mode) — the existing network.md documentation already accurately describes the current behavior
• PR [instructions] Sync github-agentic-workflows.md with v0.46.1 #16675 (Sync instructions with v0.46.1) involves removal of custom and copilot-sdk engine types — the engines.md reference does not currently document these deprecated types, so no update is needed

AI generated by Daily Documentation Updater

• expires on Feb 20, 2026, 4:30 AM UTC