[docs] Update documentation for features from 2025-10-28

[Copilot]

Updates documentation for four features merged in the last 24 hours: --zizmor security scanning flag, strict mode enforcement with zizmor, stop-after time unit restrictions, and MCP logs max_tokens parameter.

Changes

CLI Documentation (docs/src/content/docs/tools/cli.md)

• Document --zizmor flag for running security scanner on compiled workflows
• Clarify strict mode + zizmor combination treats findings as compilation errors

Trigger Reference (docs/src/content/docs/reference/triggers.md, frontmatter-full.md)

• Clarify stop-after minimum granularity is hours; minute-only units like +30m are rejected
• Combinations like +1d12h30m remain valid

MCP Server Documentation (docs/src/content/docs/tools/mcp-server.md)

• Document max_tokens parameter for logs tool (default: 12,000 tokens)
• Explain output guardrail behavior with schema and jq filtering suggestions

{
  "name": "logs",
  "arguments": {
    "count": 100,
    "max_tokens": 20000
  }
}

Referenced PRs

• Add --zizmor flag to compile command for security scanning #2639 - Add --zizmor flag to compile command
• Add strict mode enforcement for zizmor security findings #2652 - Strict mode enforcement for zizmor findings
• Reject minute units in stop-after relative time deltas #2611 - Reject minute-only units in stop-after
• Add token-based output guardrail to MCP server logs command with configurable limit #2616 - Token-based output guardrail for MCP logs

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• telemetry.astro.build
  • Triggering command: node /home/REDACTED/work/gh-aw/gh-aw/docs/node_modules/.bin/astro build (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[docs] Update documentation for features from 2025-10-28</issue_title>
<issue_description>## Documentation Updates - 2025-10-28

This PR updates the documentation based on features merged in the last 24 hours.

Features Documented

1. --zizmor flag for compile command (from Add --zizmor flag to compile command for security scanning #2639)

   • Added documentation for the new security scanning flag
   • Explained zizmor integration and output behavior

2. Strict mode + zizmor enforcement (from Add strict mode enforcement for zizmor security findings #2652)

   • Documented that strict mode treats zizmor findings as compilation errors
   • Added usage examples for --strict --zizmor combination

3. stop-after time unit clarification (from Reject minute units in stop-after relative time deltas #2611)

   • Clarified that minute-only units (e.g., +30m) are not allowed
   • Updated examples to show proper time unit combinations

4. MCP logs max_tokens parameter (from Add token-based output guardrail to MCP server logs command with configurable limit #2616)

   • Documented the new configurable token limit (default: 12,000 tokens)
   • Explained output guardrail behavior with schema and jq suggestions
   • Added usage example for customizing the limit

Changes Made

• Updated docs/src/content/docs/tools/cli.md to document --zizmor flag and strict mode behavior
• Updated docs/src/content/docs/reference/triggers.md to clarify stop-after time unit requirements
• Updated docs/src/content/docs/reference/frontmatter-full.md to add note about minute-only units
• Updated docs/src/content/docs/tools/mcp-server.md to document max_tokens parameter and output guardrail

Merged PRs Referenced

• Add --zizmor flag to compile command for security scanning #2639 - Add --zizmor flag to compile command for security scanning
• Add strict mode enforcement for zizmor security findings #2652 - Add strict mode enforcement for zizmor security findings
• Reject minute units in stop-after relative time deltas #2611 - Reject minute units in stop-after relative time deltas
• Add token-based output guardrail to MCP server logs command with configurable limit #2616 - Add token-based output guardrail to MCP server logs command with configurable limit

Additional Notes

• The toolsets rename (from Rename toolset to toolsets in GitHub tool configuration #2648) was already documented in docs: Recommend GitHub MCP Server toolsets over individual allowed tools #2647
• Internal changes and security fixes (Fix template injection vulnerability in git config user.name #2640, Always emit persist-credentials: false with actions/checkout #2641, Remove github.actor and github.workflow from allowed expressions #2642, Set detection job to explicit empty permissions #2644, Fix push-to-pull-request-branch error handling and log truncation issues #2656) did not require user-facing documentation updates
• All documentation follows the Diátaxis framework guidelines

🤖 Generated with Claude Code

AI generated by Daily Documentation Updater

---

[!NOTE]
This was originally intended as a pull request, but the git push operation failed.

Workflow Run: View run details and download patch artifact

The patch file is available as an artifact (aw.patch) in the workflow run linked above.
To apply the patch locally:

# Download the artifact from the workflow run https://github.com/githubnext/gh-aw/actions/runs/18865737760
# (Use GitHub MCP tools if gh CLI is not available)
gh run download 18865737760 -n aw.patch
# Apply the patch
git am aw.patch

Show patch preview (119 of 119 lines)

From cda1a903695c4e4e2db4d0d115f3a1a422633772 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Tue, 28 Oct 2025 06:10:15 +0000
Subject: [PATCH] [docs] Update documentation for features from 2025-10-27
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit updates documentation based on features merged in the last 24 hours.

Updates include:
- Document --zizmor flag for security scanning in compile command
- Document strict mode enforcement with zizmor findings
- Clarify stop-after time units (minute-only units not allowed)
- Document max_tokens parameter for MCP logs output guardrail

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .../docs/reference/frontmatter-full.md        |  3 ++-
 docs/src/content/docs/reference/triggers.md   |  2 +-
 docs/src/content/docs/tools/cli.md            | 10 ++++++++-
 docs/src/content/docs/tools/mcp-server.md     | 22 +++++++++++++++++++
 4 files changed, 34 insertions(+), 3 deletions(-)

diff --git a/docs/src/content/docs/reference/frontmatter-full.md b/docs/src/content/docs/reference/frontmatter-full.md
index 624fe14..9895876 100644
--- a/docs/src/content/docs/reference/frontmatter-full.md
+++ b/docs/src/content/docs/reference/frontmatter-full.md
@@ -526,7 +526,8 @@ on:
 
   # Time when workflow should stop running. Supports multiple formats: absolute
   # dates (YYYY-MM-DD HH:MM:SS, June 1 2025, 1st June 2025, 06/01/2025, etc.) or
-  # relative time deltas (+25h, +3d, +1d12h30m)
+  # relative time deltas (+25h, +3d, +1d12h30m). Note: Minute-only units (e.g., +30m)
+  # are not allowed; use hours instead (e.g., +1h).
   # (optional)
   stop-after: "exampl...

</details>

- Fixes githubnext/gh-aw#2659

<!-- START COPILOT CODING AGENT TIPS -->
---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our [2 minute survey](https://gh.io/copilot-coding-agent-survey).

[github-actions]

Agentic Changeset Generator triggered by this pull request.

[Copilot]

Pull Request Overview

This PR updates documentation to reflect four features merged on 2025-10-28: the --zizmor security scanning flag for the compile command, strict mode enforcement with zizmor, clarification of stop-after time unit requirements (no minute-only units), and the new max_tokens parameter for MCP logs output guardrails.

• Added --zizmor flag documentation for security scanning with zizmor integration
• Documented strict mode behavior treating zizmor findings as compilation errors
• Clarified that minute-only time units (e.g., +30m) are not allowed in stop-after
• Added max_tokens parameter documentation for MCP logs output size control

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
docs/src/content/docs/tools/cli.md	Documents --zizmor flag and strict mode enforcement for security scanning
docs/src/content/docs/reference/triggers.md	Clarifies stop-after time unit requirements excluding minute-only units
docs/src/content/docs/reference/frontmatter-full.md	Adds note about minute-only units not being allowed in stop-after
docs/src/content/docs/tools/mcp-server.md	Documents max_tokens parameter for logs output guardrail with schema and jq examples

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The statement 'The minimum granularity is hours' contradicts the example +1d12h30m which includes minutes. Either remove the minutes from the example or revise the explanation to clarify that minutes can be used in combination with hours/days but not alone.

Suggested change

Accepts absolute dates (`YYYY-MM-DD`, `MM/DD/YYYY`, `DD/MM/YYYY`, `January 2 2006`, `1st June 2025`, ISO 8601) or relative deltas (`+7d`, `+25h`, `+1d12h30m`) calculated from compilation time. The minimum granularity is hours - minute-only units (e.g., `+30m`) are not allowed. Recompiling the workflow resets the stop time.

Accepts absolute dates (`YYYY-MM-DD`, `MM/DD/YYYY`, `DD/MM/YYYY`, `January 2 2006`, `1st June 2025`, ISO 8601) or relative deltas (`+7d`, `+25h`, `+1d12h30m`) calculated from compilation time. The minimum granularity is hours—minute-only units (e.g., `+30m`) are not allowed, but minutes can be used in combination with hours or days (e.g., `+1d12h30m`). Recompiling the workflow resets the stop time.