[instructions] Sync github-agentic-workflows.md with v0.40.1

[github-actions]

Instructions Update - Synchronized with v0.40.1

This PR updates github-agentic-workflows.md based on code audit against the v0.40.1 release. No documentation commits modified the instructions file since the release; changes are derived from comparing code (compiler_types.go, safe_outputs_config.go, main_workflow_schema.json) to the instructions file.

Changes Made

• Add checkout: frontmatter field — This top-level field was fully implemented in the JSON schema and Go code (checkout_manager.go, compiler_orchestrator_workflow.go) but completely absent from the instructions. Documents single and multiple checkout configurations with all supported sub-fields (repository, ref, path, fetch-depth, sparse-checkout, submodules, lfs, github-token).

• Expand features: field documentation — Previously listed only as "Feature flags for experimental features (object)" with no details. Now enumerates the four known feature flags from pkg/constants/constants.go: copilot-requests (documented in changeset patch-add-copilot-requests-feature.md), mcp-gateway, dangerous-permissions-write, and disable-xpia-prompt.

• Add safe-outputs.steps: global field — This field (Steps []any yaml:"steps,omitempty") exists in SafeOutputsConfig and the JSON schema (main_workflow_schema.json lines 6953–6967) but was not documented. It injects custom steps into all safe-output jobs after checkout and before safe-output code runs.

Documentation Commits Reviewed

• a8a4ea7 Fix In private repos, events triggered in comments PRs are not able to access the PR branch #18574 (PR Fix https://github.com/github/gh-aw/issues/18574 #18578) — only changes to compiled .lock.yml files and new source files; no instructions-relevant documentation commits since the v0.40.1 release

Code Files Audited

• pkg/workflow/compiler_types.go — SafeOutputsConfig struct
• pkg/workflow/safe_outputs_config.go — safe-outputs parsing
• pkg/parser/schemas/main_workflow_schema.json — JSON schema
• pkg/constants/constants.go — feature flag constants
• pkg/workflow/checkout_manager.go — checkout config parsing

Validation

• Followed prompting best practices (imperative mood, minimal examples)
• Maintained technical tone and brevity
• Updated only necessary sections
• Verified accuracy against current codebase
• Removed no existing content (additions only)

Generated by Instructions Janitor

• expires on Mar 1, 2026, 12:01 AM UTC