[docs] Update glossary - weekly full scan#45252
Merged
Merged
Conversation
Add new terms introduced in recent changes: - sandbox.agent.runtime: new frontmatter field for container runtime selection - gVisor (runsc): kernel-level isolation runtime for the agent container - docker-sbx: KVM-isolated microVM runtime for hardware-virtualization boundaries - private-to-public-flows: opt-out field for cross-visibility MCP gateway protections - sink-visibility: MCP gateway write-sink guard field for repository visibility enforcement Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
github-actions
Bot
added
documentation
This was referenced Jul 13, 2026
Contributor
Author
|
🎉 This pull request is included in a new release. Release: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Weekly automated glossary scan for 2026-07-13. Adds 5 new reference entries across two topic areas.
Changes
File:
docs/src/content/docs/reference/glossary.mdMCP Gateway — visibility controls (2 entries)
private-to-public-flows(tools.github.private-to-public-flows) — frontmatter field that opts a workflow out of cross-visibility protections enforced by the MCP Gateway. Supportsallow(all MCP servers) or a list of server IDs. Incompatible withguards_mode: strictin blanket-allow form.sink-visibility— MCP Gateway write-sink guard field that declares the target repository visibility ("public","private","internal"). When"public", agents with non-empty secrecy are blocked from writing. Set automatically by the gh-aw compiler at runtime; workflow authors do not configure it manually.Sandbox — container runtimes (3 entries)
sandbox.agent.runtime— selects the container runtime for the AI agent. Supported values:gvisor(kernel-level isolation via user-space kernel) anddocker-sbx(KVM-isolated microVM). Defaults to standard Docker when omitted.gVisor (runsc)— Google container runtime that interposes a user-space kernel between the agent container and host OS kernel. gh-aw installs and registers gVisor automatically.docker-sbx— KVM-hardware-virtualized microVM runtime. Infrastructure containers remain on the host; gh-aw refreshes Docker Hub OAuth credentials automatically before agent execution.Type
docs
Scope
docs/src/content/docs/reference/glossary.md