Getting Began with GitHub Agentic Workflows

# Introducing GitHub’s Agentic Workflows

 
It is 9 AM on a Monday, and forty-three new points are sitting within the backlog. Some are actual bugs. Some are duplicate function requests. A pair are simply somebody venting a few typo. Whoever is on triage responsibility this week goes to spend the primary two hours of their day studying, labelling, and replying to all of them earlier than they will contact something they really deliberate to construct.

That is the precise form of work GitHub constructed Agentic Workflows to take off your plate. On June 11, 2026, GitHub moved Agentic Workflows into public preview, giving each repository the flexibility to run coding brokers inside GitHub Actions to deal with precisely this sort of reasoning-heavy, repetitive work. Not code completion. Not a chat sidebar. A scheduled or event-triggered agent that reads a difficulty, a pull request, or every week’s value of commits, and does one thing helpful with what it finds.

This text walks by means of what the function really is, why the safety mannequin issues greater than the pitch-deck model of it, and the way to write, compile, and run your first workflow right now. By the top, you may have a working triage workflow of your individual and a transparent sense of what is nonetheless a bit tough across the edges.

# What Are GitHub Agentic Workflows?

 
Strip away the advertising and marketing language, and the concept is pretty easy. You write a Markdown file that lives in .github/workflows/. The highest of that file has a small block of YAML frontmatter describing when the workflow runs, what it is allowed to the touch, and which AI engine powers it. Beneath the frontmatter, you write plain-English directions describing what you need the agent to do.

A command-line interface (CLI) instrument referred to as gh-aw reads that Markdown file and compiles it right into a .lock.yml file, which is a very odd GitHub Actions workflow. That is the half value sitting with for a second: there isn’t any separate agent runtime bolted onto your repository. It reuses your present runners, your present department safety guidelines, and your present coverage constraints, as a result of beneath the pure language, it is simply Actions.

The venture is constructed by GitHub Subsequent and Microsoft Analysis, and it at the moment helps 4 AI engines out of the field: GitHub Copilot, Anthropic’s Claude, OpenAI Codex, and Google Gemini, with the choice to plug in a customized processor if none of these match. Copilot is the default engine, and in case your group already pays for a Copilot plan, workflow runs can invoice on to that group as an alternative of requiring you to handle a separate API key.

It additionally sits inside an even bigger thought GitHub calls Steady AI, which is de facto simply the observe of making use of AI systematically throughout the software program lifecycle as an alternative of 1 immediate at a time. Agentic Workflows is the mechanism for doing that on a schedule or in response to repository occasions, slightly than solely when an individual occurs to be sitting at their keyboard asking Copilot a query.

It is also value being clear about what this isn’t. It is not the identical factor as Copilot’s cloud coding agent, which you kick off manually from a difficulty or a pull request once you need an agent to implement one thing particular for you proper now. Agentic Workflows is nearer to a standing coverage: “each Monday, summarize the week’s challenge exercise” or “each time a PR opens, overview it for safety considerations.” One is a activity you hand off. The opposite is a behavior you construct into the repository itself.

# Why This Is Price Paying Consideration To

 
GitHub would not usually publish adoption numbers this early in a preview, so the truth that they connected named buyer quotes to the launch says one thing about how far alongside the interior testing already was.

Carvana instructed GitHub the flexibleness and built-in controls gave their engineering group sufficient confidence to run agentic workflows throughout genuinely complicated methods, together with adjustments that contact multiple repository at a time, in response to the official changelog. Marks & Spencer described an identical story from a unique angle: their builders had been dropping actual dash hours to the boring stuff — challenge triage, dependency upkeep, vulnerability remediation, and routine overview — and constructing a shared catalogue of reusable agentic workflows let groups decide up that automation throughout any repository with out reinventing it every time.

Hud.io made some extent that is straightforward to overlook in the event you’re solely skimming the function listing: getting an agent to open a pull request was by no means the arduous a part of this. Trusting the output sufficient to really merge it’s. That is actually the entire thesis behind the safety design lined within the subsequent part.

Here is the form of the function because it stands right now, pulled instantly from GitHub’s personal numbers web page:

# The Safety Mannequin Is the Actual Story Right here

 
Most “AI does your DevOps now” pitches skip straight previous the plain query: what occurs when the agent will get it improper, or worse, will get manipulated by one thing hostile sitting inside a difficulty remark or a file within the repo. Immediate injection by means of repository content material is a recognized danger with any agent that reads untrusted textual content, and GitHub constructed 5 layers particularly to comprise that, slightly than fake it could possibly’t occur.

1. Learn-only tokens: The agent’s GitHub token is scoped to read-only entry by default. If it tries to push code, open a PR, or delete a file instantly, the token itself would not enable it, no matter what the agent decides to aim.
2. Zero secrets and techniques within the agent course of: The method really operating the AI mannequin by no means receives write tokens, API keys, or credentials of any type. These dwell solely in a separate job that runs after the agent has already completed and its proposed output has been checked. If the agent is compromised mid-run, there’s nothing in its attain value stealing.
3. A sandboxed container behind a community firewall: The agent executes inside an remoted container, and all outbound site visitors is routed by means of what GitHub calls the Agent Workflow Firewall, a Squid proxy imposing an specific allowlist of domains. Something outdoors that allowlist will get dropped on the kernel stage, so a compromised agent has no path to quietly telephone residence together with your knowledge.
4. Protected outputs: That is the half value understanding correctly, as a result of it is the mechanism that makes the remainder of the mannequin work in observe. The agent cannot write to your repository instantly in any respect. As an alternative, it produces a structured description of what it desires to do — one thing like “open a difficulty with this title and this physique.” A separate job with narrowly scoped write permissions reads that request and applies solely what you’ve got explicitly allowed within the workflow’s frontmatter: a tough cap of 1 challenge per run, a required title prefix, particular label restrictions, no matter you resolve. The agent proposes. A gated, deterministic job disposes.
5. Agentic risk detection: Earlier than any of that output really lands in your repo, a devoted threat-detection job runs its personal AI-powered scan throughout the proposed adjustments, checking for injection makes an attempt, leaked credentials, or suspicious code patterns. If one thing appears to be like improper, the entire run fails, and nothing will get written.

Put collectively, the agent can learn virtually something in your repository, however it could possibly solely ever act by means of a slim, auditable contract you outline your self. That is a meaningfully completely different belief mannequin from putting in a third-party GitHub Motion and granting it broad write permissions on religion.

# What You Want Earlier than You Begin

 
You do not want a lot to get going, however every of those issues:

An account with one of many supported AI engines: GitHub Copilot, Anthropic Claude, OpenAI Codex, or Google Gemini. A GitHub repository the place you have got write entry. GitHub Actions have to be enabled on that repository. And the GitHub CLI, model 2.0.0 or later, should already be authenticated in your machine.

Verify your CLI model with gh --version, and if you’ll want to authenticate, run:

# Logs your native gh CLI into GitHub with the 2 scopes
# agentic workflows want: repo entry and workflow write entry
gh auth login --scopes repo,workflow

As soon as that is accomplished, set up the extension that does the precise Markdown-to-YAML compilation:

# Installs the gh-aw extension into your present GitHub CLI
gh extension set up github/gh-aw

For those who’re already on GitHub CLI 2.90.0 or newer, operating any gh aw command will supply to put in this mechanically the primary time you employ it, so you will not hit a missing-extension error out of nowhere.

# Setting Up Authentication

 
That is the one step that journeys up virtually everybody the primary time, so it is value slowing down right here.

For those who’re utilizing GitHub Copilot inside a repository owned by a corporation with a Copilot plan, you need the built-in GITHUB_TOKEN strategy. It payments utilization straight to your group and means no person has to babysit a private entry token (PAT) as a repo secret. Your group admin must allow “Enable use of Copilot CLI billed to the group” below Copilot coverage settings first. As soon as that is on, all you want in your workflow frontmatter is:

permissions:
  contents: learn
  copilot-requests: write   # routes Copilot billing by means of the org, not a private token

This can be a genuinely current change value calling out instantly: as of the identical June 11, 2026 launch, GitHub Agentic Workflows not requires a PAT in any respect for this path. Earlier hands-on writeups from the technical preview interval in February 2026 describe producing a fine-grained PAT with Copilot Requests permission and manually including it as a COPILOT_GITHUB_TOKEN secret. That step nonetheless exists as an possibility for private repositories or for third-party engines like Claude or Codex that want their very own API key saved as a secret, however in the event you’re operating Copilot inside an org-owned repo, you’ll be able to skip the token dance completely now.

For something that does want a saved secret (private repos, or Claude and Codex as your engine), you add it as soon as by means of your repository’s Actions secrets and techniques, both within the GitHub UI or with gh aw secrets and techniques set from the CLI.

# Writing Your First Workflow

 
Let’s construct one thing you’d really need operating in an actual repository: an agent that triages new points the second they’re opened, classifies them, labels them, and posts a brief, helpful response.

You might write this file by hand, however a greater first expertise is to let a coding agent scaffold it for you. Run this as soon as per repository to set that up:

# Provides abilities, directions, and a helper agent to this repo
# so any coding agent you employ afterward understands the way to
# creator and edit agentic workflows appropriately
gh aw init

Then, from inside your coding agent of selection (Copilot CLI or VS Code agent mode each work), you’d immediate one thing like: create a brand new workflow that triages newly opened points, classifies them by kind and precedence, applies labels, and posts an acknowledgement remark. The agent handles the file creation and the primary compile go for you.

But it surely helps to really learn and perceive the file it produces, so here is a hand-written model you’ll be able to drop straight into .github/workflows/issue-triage.md:

---
description: Classify new points, apply labels, and put up a brief response
on:
  points:
    sorts: [opened]        # solely fires when a brand-new challenge is created

permissions:
  contents: learn            # agent can learn repo recordsdata for context
  points: learn               # agent can learn the difficulty itself

community: defaults            # outbound site visitors restricted to the default allowlist

instruments:
  github:
    toolsets: [issues]       # solely issue-related GitHub instruments are uncovered

safe-outputs:
  add-label:
    max: 3                   # by no means apply greater than 3 labels in a single run
  add-comment:
    max: 1                   # precisely one acknowledgment remark, by no means extra
---

# Problem Triage Agent

When a brand new challenge is opened, learn its title, physique, and any code
snippets included in it.

Classify the difficulty as certainly one of: bug, function request, query, or
documentation hole.

Assess precedence as important, excessive, medium, or low, based mostly on how
a lot of the system the difficulty impacts and whether or not it blocks different
customers.

Apply labels that mirror each the sort and the precedence.

Publish one brief remark thanking the reporter, restating your
classification in plain language, and letting them know a
maintainer will comply with up if it is excessive precedence or above.

Hold the remark below 4 sentences. Do not speculate a few
repair. Simply acknowledge and route.

What this file is definitely doing, line by line: The on block means this solely runs when somebody opens a brand new challenge, not on edits or feedback, which retains operating low-cost and predictable. The permissions block is intentionally slim — read-only on each repo contents and points — as a result of the agent’s job right here is to look at and classify, to not modify something instantly. community: defaults retains outbound calls restricted to GitHub’s commonplace allowlist slightly than opening the container as much as the broader web. The instruments block scopes down which GitHub API floor the agent even has entry to, so it could possibly’t, say, begin shopping pull requests when all it wants is challenge knowledge. And the safe-outputs block is the precise belief boundary mentioned earlier on this article: the agent can counsel as much as three labels and precisely one remark, and nothing else, it doesn’t matter what it decides mid-run can be a good suggestion.

As soon as the file is saved, compile it:

# Reads the Markdown file and generates the true GitHub Actions
# YAML (issue-triage.lock.yml) that Actions will really run
gh aw compile

Commit each the .md file and the generated .lock.yml file collectively. Sure, each recordsdata go into model management. The Markdown is your supply of reality, and the lock file is what Actions executes — comparable in spirit to how a bundle lock file sits alongside a manifest.

Push, open a take a look at challenge, and watch the Actions tab. Or set off it manually with out ready for an actual challenge:

# Manually kicks off a workflow run by title, helpful for testing
# earlier than you depend on the true occasion set off
gh aw run issue-triage

# Understanding Each Discipline within the Frontmatter

 
The instance above solely used a handful of fields, nevertheless it helps to know the total form of what is accessible earlier than you begin writing your individual workflows from scratch.

The complete reference lives on the gh-aw frontmatter documentation, and it is value bookmarking when you begin writing workflows that transcend a single set off.

# Widespread Patterns Price Realizing

 
GitHub paperwork greater than eighteen recurring design patterns for these workflows, and most actual utilization clusters round a handful of them.

1. IssueOps is precisely what the triage instance above demonstrates: an agent that reacts to challenge occasions and manages the lifecycle of particular person points.
2. DailyOps or WeeklyOps patterns run on a schedule slightly than an occasion, producing digests, studies, or well being checks. GitHub’s personal documentation instance for this can be a weekly challenge exercise report: an agent that opinions the final seven days of challenge exercise and opens a single abstract challenge masking totals, recurring themes, and a brief listing of things that also want consideration, utilizing nothing greater than a schedule set off and a create-issue protected output capped at one per run.
3. ChatOps patterns reply to feedback or mentions, letting a maintainer kind one thing like "@bot summarize this thread" instantly into a difficulty or PR and get a structured response again.
4. BatchOps patterns course of many objects without delay on a schedule — issues like scanning each open dependency-update PR for merge conflicts, or flagging stale points throughout a whole repository in a single go.

You needn’t memorize the total taxonomy. What issues is recognizing that just about something you’d need automated matches certainly one of these shapes, and ranging from an present sample is way quicker than designing your individual from a clean web page.

# Reusing Workflows As an alternative of Writing Your Personal

 
You do not have to start out from zero each time. GitHub Subsequent maintains a public catalogue referred to as agentics with ready-made workflows masking triage, compliance checks, reporting, and extra. You possibly can pull one instantly into your repository:

# Imports a pre-built workflow from GitHub Subsequent's public catalogue
# and walks you thru configuring it interactively
gh aw add-wizard githubnext/agentics/daily-repo-status

For a non-interactive setup, gh aw add works the identical approach and allows you to pin a particular model. While you import a workflow this manner, the CLI data a supply: worth within the frontmatter, which is how gh aw replace later is aware of the place to drag upstream adjustments from.

Two issues value being cautious about right here. First, solely import workflows from sources you really belief and have reviewed, because you’re successfully giving an AI agent an outlined however actual slice of entry to your repository based mostly on another person’s directions. Second, workflows marked non-public: true of their supply repo cannot be imported elsewhere in any respect, so do not anticipate each inner group’s workflow catalogue to be reusable outdoors its personal org.

# What’s Genuinely Nonetheless Tough

 
It will be dishonest to write down a getting-started information for a public preview function and fake the whole lot is polished. Just a few issues are value understanding entering into, based mostly on actual hands-on accounts from builders who’ve really run this in production-adjacent repos, together with an in depth write-up from developer Hector Flores documenting 4 workflows he constructed and ran.

Debugging remains to be opaque in locations. When an agent makes a classification you did not anticipate, your solely actual window into why is commonplace GitHub Actions logs, not a structured reasoning hint explaining the choice. That is workable for now, nevertheless it’s the very first thing energy customers ask for.

There is not any real-time value visibility per workflow run. Every execution consumes AI tokens in opposition to your engine’s billing, and whilst you can examine total utilization after the very fact, there isn’t any per-workflow estimate to assist a group set a funds earlier than turning one thing on throughout dozens of repositories.

The .lock.yml compilation step appears like scaffolding slightly than a everlasting a part of the design. It really works reliably, however the two-file sample (Markdown supply plus generated lock file) reads like one thing that can finally get absorbed instantly into the platform, the place you push a .md file and GitHub compiles it natively and not using a separate CLI step.

None of that ought to cease you from making an attempt it. It ought to simply set your expectations appropriately: this can be a fast-moving public preview, not a completed product, and the components of it that can matter most in a 12 months — the safe-outputs contract and the layered safety mannequin — are already the strongest a part of what exists right now.

# The place This Matches Subsequent to Different Copilot Instruments

 
It is easy to conflate this with different issues GitHub already ships below the Copilot title, so here is a fast side-by-side to maintain them straight.

None of those three substitute one another. A wholesome setup normally runs all three without delay: customized Actions for deterministic checks like linting and assessments, the cloud coding agent for once you wish to hand off a particular function, and Agentic Workflows for the recurring judgment calls that do not match a hard and fast rule but in addition do not want an individual to kick them off each time.

# Closing Ideas

 
Essentially the most helpful approach to consider GitHub Agentic Workflows is not “AI writes my YAML now.” It is that you could lastly encode judgment calls into automation as an alternative of solely guidelines. A standard Motion can implement “each PR touching src/auth/ wants a safety overview.” An agentic workflow can act on “flag something that appears security-sensitive and route it appropriately” — which is a genuinely completely different and tougher drawback that used to require an individual paying consideration each single time.

For those who’re making an attempt this for the primary time, begin with challenge triage. It is the best sample; the safe-outputs contract is simple to purpose about with solely a remark and a label at stake, and you may see it work or fail inside minutes of opening a take a look at challenge. As soon as that clicks, the bounce to scheduled studies, PR overview, and documentation maintenance is a a lot smaller leap than it appears to be like like from the skin.

Learn by means of the official quickstart information for essentially the most present setup steps, and in the event you construct one thing value sharing again, the group dialogue is the place GitHub is actively accumulating suggestions whereas the function remains to be in preview.
 
 

Shittu Olumide is a software program engineer and technical author captivated with leveraging cutting-edge applied sciences to craft compelling narratives, with a eager eye for element and a knack for simplifying complicated ideas. You can too discover Shittu on Twitter.