From 09c2bda9b74e64e5c31a1ef9b22d1f3c1c56306f Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Thu, 23 Jul 2026 10:58:51 +0000
Subject: [PATCH] docs: update glossary with grant, syft, yamllint scanner
 terms

Add three new terms from recent compile pipeline additions:
- grant: license scanning for container images (--grant flag)
- syft: SBOM generation tool for container images (--syft flag)
- yamllint: YAML linting for generated workflow files (--yamllint flag)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 docs/src/content/docs/reference/glossary.md | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/docs/src/content/docs/reference/glossary.md b/docs/src/content/docs/reference/glossary.md
index 54a4af0ead3..322de80c99b 100644
--- a/docs/src/content/docs/reference/glossary.md
+++ b/docs/src/content/docs/reference/glossary.md
@@ -1114,10 +1114,18 @@ An `aw.json` configuration field that redirects action references to replacement
 
 A static analysis tool for GitHub Actions workflow files that detects syntax errors, type mismatches, and other issues. Integrated into `gh aw compile` via the `--actionlint` flag. Runs in a Docker container and reports lint findings separately from tooling/integration errors (such as Docker failures or timeouts) that prevent the linter from running. See `--actionlint --zizmor --poutine` in the [Compilation Reference](/gh-aw/reference/compilation-process/).
 
+### grant
+
+A license scanning tool that analyzes container images for software licenses. Integrated into `gh aw compile` via the `--grant` flag. Uses a `.grant.yaml` policy file to define allowed and disallowed licenses, then evaluates each container image referenced in the workflow. Typically used alongside [syft](#syft) for SBOM generation. See [Compilation Reference](/gh-aw/reference/compilation-process/).
+
 ### poutine
 
 A security linter for GitHub Actions workflows that detects supply-chain vulnerabilities such as unpinned actions and dangerous use of pull request events. Integrated into `gh aw compile` via the `--poutine` flag. Typically used alongside [actionlint](#actionlint) and [zizmor](#zizmor).
 
+### syft
+
+A Software Bill of Materials (SBOM) generation tool that catalogs packages and dependencies in container images. Integrated into `gh aw compile` via the `--syft` flag. Produces a structured inventory of all software components in Docker images used by the workflow. Typically used alongside [grant](#grant) for license policy enforcement. See [Compilation Reference](/gh-aw/reference/compilation-process/).
+
 ### Validation
 
 Checking workflow files for errors, security issues, and best practices. Occurs during compilation and can be enhanced with strict mode and security scanners.
@@ -1126,6 +1134,10 @@ Checking workflow files for errors, security issues, and best practices. Occurs
 
 A CLI command that runs actionlint on existing `.lock.yml` workflow files without recompiling the source Markdown. Unlike `gh aw compile --actionlint`, it reads lock files directly from disk, skipping `zizmor` and `poutine`. Supports `--shellcheck` and `--pyflakes` flags to enable script integrations for shell and Python analysis. Useful for fast local feedback after manual lock-file edits. See [CLI Reference](/gh-aw/setup/cli/).
 
+### yamllint
+
+A YAML linting tool that validates the syntax and style of generated workflow files. Integrated into `gh aw compile` via the `--yamllint` flag. Runs against the compiled `.lock.yml` output to catch YAML formatting issues before the workflow is executed. See [Compilation Reference](/gh-aw/reference/compilation-process/).
+
 ### zizmor
 
 A security auditing tool for GitHub Actions workflows that identifies vulnerabilities including script injections, excessive permissions, and unsafe use of GitHub context expressions. Integrated into `gh aw compile` via the `--zizmor` flag. Typically used alongside [actionlint](#actionlint) and [poutine](#poutine).