From be2ed5fa9e740edfe429940afea86498164baa83 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Tue, 7 Jul 2026 11:18:49 +0000
Subject: [PATCH] docs: update glossary - daily scan 2026-07-07

Added term: Built-in Job Needs Augmentation (jobs.<built-in>.needs)
- Introduced in PR #43940 (Allow jobs.<generated>.needs to augment compiler-generated job dependencies)
- User-facing frontmatter feature for explicit dependency ordering of built-in jobs

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 docs/src/content/docs/reference/glossary.md | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/docs/src/content/docs/reference/glossary.md b/docs/src/content/docs/reference/glossary.md
index da33e3fa40e..837b8e3d0d0 100644
--- a/docs/src/content/docs/reference/glossary.md
+++ b/docs/src/content/docs/reference/glossary.md
@@ -444,6 +444,23 @@ engine:
   bare: true
 ```
 
+### Built-in Job Needs Augmentation (`jobs.<built-in>.needs`)
+
+A frontmatter field that adds explicit dependency ordering for compiler-generated jobs (`activation`, `agent`, `detection`, `safe_outputs`, `conclusion`). When `jobs.<built-in>.needs` is set, the listed jobs are merged additively into the compiler's computed dependency list for that built-in job — compiler-required dependencies are never removed. Use this when implicit `engine.env` inference does not detect a dependency, for example when a custom job's output is consumed inside a built-in job's configuration via `${{ jobs.my_job.outputs.value }}`. Both hyphen and underscore forms are accepted (`safe-outputs` or `safe_outputs`). Validation at compile time rejects unknown targets, self-dependencies, and augmentation of built-in jobs not present in the current workflow. See [Custom Steps and Jobs Reference](/gh-aw/reference/steps-jobs/).
+
+```aw wrap
+jobs:
+  select_model:
+    runs-on: ubuntu-latest
+    outputs:
+      model: ${{ steps.pick.outputs.model }}
+    steps:
+      - id: pick
+        run: echo "model=gpt-4o" >> $GITHUB_OUTPUT
+  agent:
+    needs: [select_model]
+```
+
 ### BYOK (Bring Your Own Key)
 
 A Copilot engine mode that routes AI requests to an external LLM provider (such as OpenAI, Anthropic, or a self-hosted Ollama/vLLM instance) instead of the default GitHub Copilot backend. Activated by setting `COPILOT_PROVIDER_BASE_URL` in `engine.env`. The three BYOK credential variables (`COPILOT_PROVIDER_BASE_URL`, `COPILOT_PROVIDER_API_KEY`, `COPILOT_PROVIDER_BEARER_TOKEN`) accept `${{ secrets.* }}` references under strict mode and are never exposed to the agent container. gh-aw automatically adds the provider hostname to the AWF allow-list when it can resolve a literal BYOK URL, and otherwise reuses the concrete provider hostname from `network.allowed` for the threat-detection Copilot step. Use `COPILOT_MODEL` to specify the target model. See [AI Engines Reference](/gh-aw/reference/engines/#copilot-bring-your-own-key-byok-mode).