Getting Began with GitHub Agentic Workflows

# Introducing GitHub’s Agentic Workflows

 
It is 9 AM on a Monday, and forty-three new points are sitting within the backlog. Some are actual bugs. Some are duplicate characteristic requests. A pair are simply somebody venting a couple of typo. Whoever is on triage responsibility this week goes to spend the primary two hours of their day studying, labelling, and replying to all of them earlier than they’ll contact something they really deliberate to construct.

That is the precise type of work GitHub constructed Agentic Workflows to take off your plate. On June 11, 2026, GitHub moved Agentic Workflows into public preview, giving each repository the flexibility to run coding brokers inside GitHub Actions to deal with precisely this type of reasoning-heavy, repetitive work. Not code completion. Not a chat sidebar. A scheduled or event-triggered agent that reads a problem, a pull request, or per week’s value of commits, and does one thing helpful with what it finds.

This text walks by way of what the characteristic really is, why the safety mannequin issues greater than the pitch-deck model of it, and how you can write, compile, and run your first workflow right this moment. By the top, you may have a working triage workflow of your individual and a transparent sense of what is nonetheless a bit tough across the edges.

# What Are GitHub Agentic Workflows?

 
Strip away the advertising language, and the concept is pretty easy. You write a Markdown file that lives in .github/workflows/. The highest of that file has a small block of YAML frontmatter describing when the workflow runs, what it is allowed to the touch, and which AI engine powers it. Beneath the frontmatter, you write plain-English directions describing what you need the agent to do.

A command-line interface (CLI) device known as gh-aw reads that Markdown file and compiles it right into a .lock.yml file, which is a totally abnormal GitHub Actions workflow. That is the half value sitting with for a second: there isn’t any separate agent runtime bolted onto your repository. It reuses your current runners, your current department safety guidelines, and your current coverage constraints, as a result of beneath the pure language, it is simply Actions.

The challenge is constructed by GitHub Subsequent and Microsoft Analysis, and it at the moment helps 4 AI engines out of the field: GitHub Copilot, Anthropic’s Claude, OpenAI Codex, and Google Gemini, with the choice to plug in a customized processor if none of these match. Copilot is the default engine, and in case your group already pays for a Copilot plan, workflow runs can invoice on to that group as an alternative of requiring you to handle a separate API key.

It additionally sits inside an even bigger thought GitHub calls Steady AI, which is absolutely simply the follow of making use of AI systematically throughout the software program lifecycle as an alternative of 1 immediate at a time. Agentic Workflows is the mechanism for doing that on a schedule or in response to repository occasions, reasonably than solely when an individual occurs to be sitting at their keyboard asking Copilot a query.

It is also value being clear about what this isn’t. It is not the identical factor as Copilot’s cloud coding agent, which you kick off manually from a problem or a pull request while you need an agent to implement one thing particular for you proper now. Agentic Workflows is nearer to a standing coverage: “each Monday, summarize the week’s difficulty exercise” or “each time a PR opens, evaluate it for safety issues.” One is a process you hand off. The opposite is a behavior you construct into the repository itself.

# Why This Is Value Paying Consideration To

 
GitHub does not usually publish adoption numbers this early in a preview, so the truth that they hooked up named buyer quotes to the launch says one thing about how far alongside the inner testing already was.

Carvana advised GitHub the pliability and built-in controls gave their engineering staff sufficient confidence to run agentic workflows throughout genuinely complicated programs, together with modifications that contact a couple of repository at a time, based on the official changelog. Marks & Spencer described an analogous story from a distinct angle: their builders had been dropping actual dash hours to the boring stuff — difficulty triage, dependency upkeep, vulnerability remediation, and routine evaluate — and constructing a shared catalogue of reusable agentic workflows let groups decide up that automation throughout any repository with out reinventing it every time.

Hud.io made a degree that is straightforward to overlook in the event you’re solely skimming the characteristic record: getting an agent to open a pull request was by no means the laborious a part of this. Trusting the output sufficient to really merge it’s. That is actually the entire thesis behind the safety design lined within the subsequent part.

This is the form of the characteristic because it stands right this moment, pulled straight from GitHub’s personal numbers web page:

# The Safety Mannequin Is the Actual Story Right here

 
Most “AI does your DevOps now” pitches skip straight previous the plain query: what occurs when the agent will get it fallacious, or worse, will get manipulated by one thing hostile sitting inside a problem remark or a file within the repo. Immediate injection by way of repository content material is a recognized threat with any agent that reads untrusted textual content, and GitHub constructed 5 layers particularly to include that, reasonably than faux it may’t occur.

1. Learn-only tokens: The agent’s GitHub token is scoped to read-only entry by default. If it tries to push code, open a PR, or delete a file straight, the token itself does not enable it, no matter what the agent decides to try.
2. Zero secrets and techniques within the agent course of: The method really operating the AI mannequin by no means receives write tokens, API keys, or credentials of any type. These stay solely in a separate job that runs after the agent has already completed and its proposed output has been checked. If the agent is compromised mid-run, there’s nothing in its attain value stealing.
3. A sandboxed container behind a community firewall: The agent executes inside an remoted container, and all outbound site visitors is routed by way of what GitHub calls the Agent Workflow Firewall, a Squid proxy imposing an specific allowlist of domains. Something outdoors that allowlist will get dropped on the kernel stage, so a compromised agent has no path to quietly telephone house along with your knowledge.
4. Protected outputs: That is the half value understanding correctly, as a result of it is the mechanism that makes the remainder of the mannequin work in follow. The agent cannot write to your repository straight in any respect. As an alternative, it produces a structured description of what it desires to do — one thing like “open a problem with this title and this physique.” A separate job with narrowly scoped write permissions reads that request and applies solely what you have explicitly allowed within the workflow’s frontmatter: a tough cap of 1 difficulty per run, a required title prefix, particular label restrictions, no matter you determine. The agent proposes. A gated, deterministic job disposes.
5. Agentic risk detection: Earlier than any of that output really lands in your repo, a devoted threat-detection job runs its personal AI-powered scan throughout the proposed modifications, checking for injection makes an attempt, leaked credentials, or suspicious code patterns. If one thing seems to be fallacious, the entire run fails, and nothing will get written.

Put collectively, the agent can learn virtually something in your repository, however it may solely ever act by way of a slender, auditable contract you outline your self. That is a meaningfully totally different belief mannequin from putting in a third-party GitHub Motion and granting it broad write permissions on religion.

# What You Want Earlier than You Begin

 
You do not want a lot to get going, however every of those issues:

An account with one of many supported AI engines: GitHub Copilot, Anthropic Claude, OpenAI Codex, or Google Gemini. A GitHub repository the place you could have write entry. GitHub Actions should be enabled on that repository. And the GitHub CLI, model 2.0.0 or later, should already be authenticated in your machine.

Verify your CLI model with gh --version, and if it’s essential authenticate, run:

# Logs your native gh CLI into GitHub with the 2 scopes
# agentic workflows want: repo entry and workflow write entry
gh auth login --scopes repo,workflow

As soon as that is completed, set up the extension that does the precise Markdown-to-YAML compilation:

# Installs the gh-aw extension into your current GitHub CLI
gh extension set up github/gh-aw

If you happen to’re already on GitHub CLI 2.90.0 or newer, operating any gh aw command will provide to put in this robotically the primary time you utilize it, so you will not hit a missing-extension error out of nowhere.

# Setting Up Authentication

 
That is the one step that journeys up virtually everybody the primary time, so it is value slowing down right here.

If you happen to’re utilizing GitHub Copilot inside a repository owned by a corporation with a Copilot plan, you need the built-in GITHUB_TOKEN strategy. It payments utilization straight to your group and means no one has to babysit a private entry token (PAT) as a repo secret. Your group admin must allow “Permit use of Copilot CLI billed to the group” below Copilot coverage settings first. As soon as that is on, all you want in your workflow frontmatter is:

permissions:
  contents: learn
  copilot-requests: write   # routes Copilot billing by way of the org, not a private token

This can be a genuinely current change value calling out straight: as of the identical June 11, 2026 launch, GitHub Agentic Workflows not requires a PAT in any respect for this path. Earlier hands-on writeups from the technical preview interval in February 2026 describe producing a fine-grained PAT with Copilot Requests permission and manually including it as a COPILOT_GITHUB_TOKEN secret. That step nonetheless exists as an possibility for private repositories or for third-party engines like Claude or Codex that want their very own API key saved as a secret, however in the event you’re operating Copilot inside an org-owned repo, you may skip the token dance solely now.

For something that does want a saved secret (private repos, or Claude and Codex as your engine), you add it as soon as by way of your repository’s Actions secrets and techniques, both within the GitHub UI or with gh aw secrets and techniques set from the CLI.

# Writing Your First Workflow

 
Let’s construct one thing you’d really need operating in an actual repository: an agent that triages new points the second they’re opened, classifies them, labels them, and posts a brief, helpful response.

You could possibly write this file by hand, however a greater first expertise is to let a coding agent scaffold it for you. Run this as soon as per repository to set that up:

# Provides expertise, directions, and a helper agent to this repo
# so any coding agent you utilize afterward understands how you can
# writer and edit agentic workflows appropriately
gh aw init

Then, from inside your coding agent of alternative (Copilot CLI or VS Code agent mode each work), you’d immediate one thing like: create a brand new workflow that triages newly opened points, classifies them by sort and precedence, applies labels, and posts an acknowledgement remark. The agent handles the file creation and the primary compile cross for you.

But it surely helps to really learn and perceive the file it produces, so here is a hand-written model you may drop straight into .github/workflows/issue-triage.md:

---
description: Classify new points, apply labels, and put up a brief response
on:
  points:
    sorts: [opened]        # solely fires when a brand-new difficulty is created

permissions:
  contents: learn            # agent can learn repo recordsdata for context
  points: learn               # agent can learn the problem itself

community: defaults            # outbound site visitors restricted to the default allowlist

instruments:
  github:
    toolsets: [issues]       # solely issue-related GitHub instruments are uncovered

safe-outputs:
  add-label:
    max: 3                   # by no means apply greater than 3 labels in a single run
  add-comment:
    max: 1                   # precisely one acknowledgment remark, by no means extra
---

# Difficulty Triage Agent

When a brand new difficulty is opened, learn its title, physique, and any code
snippets included in it.

Classify the problem as one in all: bug, characteristic request, query, or
documentation hole.

Assess precedence as vital, excessive, medium, or low, primarily based on how
a lot of the system the problem impacts and whether or not it blocks different
customers.

Apply labels that mirror each the sort and the precedence.

Publish one brief remark thanking the reporter, restating your
classification in plain language, and letting them know a
maintainer will comply with up if it is excessive precedence or above.

Hold the remark below 4 sentences. Do not speculate a couple of
repair. Simply acknowledge and route.

What this file is definitely doing, line by line: The on block means this solely runs when somebody opens a brand new difficulty, not on edits or feedback, which retains operating low-cost and predictable. The permissions block is intentionally slender — read-only on each repo contents and points — as a result of the agent’s job right here is to watch and classify, to not modify something straight. community: defaults retains outbound calls restricted to GitHub’s customary allowlist reasonably than opening the container as much as the broader web. The instruments block scopes down which GitHub API floor the agent even has entry to, so it may’t, say, begin looking pull requests when all it wants is difficulty knowledge. And the safe-outputs block is the precise belief boundary mentioned earlier on this article: the agent can recommend as much as three labels and precisely one remark, and nothing else, it doesn’t matter what it decides mid-run can be a good suggestion.

As soon as the file is saved, compile it:

# Reads the Markdown file and generates the actual GitHub Actions
# YAML (issue-triage.lock.yml) that Actions will really run
gh aw compile

Commit each the .md file and the generated .lock.yml file collectively. Sure, each recordsdata go into model management. The Markdown is your supply of reality, and the lock file is what Actions executes — related in spirit to how a package deal lock file sits alongside a manifest.

Push, open a check difficulty, and watch the Actions tab. Or set off it manually with out ready for an actual difficulty:

# Manually kicks off a workflow run by identify, helpful for testing
# earlier than you depend on the actual occasion set off
gh aw run issue-triage

# Understanding Each Discipline within the Frontmatter

 
The instance above solely used a handful of fields, but it surely helps to know the complete form of what is obtainable earlier than you begin writing your individual workflows from scratch.

The total reference lives on the gh-aw frontmatter documentation, and it is value bookmarking when you begin writing workflows that transcend a single set off.

# Widespread Patterns Value Figuring out

 
GitHub paperwork greater than eighteen recurring design patterns for these workflows, and most actual utilization clusters round a handful of them.

1. IssueOps is strictly what the triage instance above demonstrates: an agent that reacts to difficulty occasions and manages the lifecycle of particular person points.
2. DailyOps or WeeklyOps patterns run on a schedule reasonably than an occasion, producing digests, experiences, or well being checks. GitHub’s personal documentation instance for this can be a weekly difficulty exercise report: an agent that opinions the final seven days of difficulty exercise and opens a single abstract difficulty protecting totals, recurring themes, and a brief record of things that also want consideration, utilizing nothing greater than a schedule set off and a create-issue protected output capped at one per run.
3. ChatOps patterns reply to feedback or mentions, letting a maintainer sort one thing like "@bot summarize this thread" straight into a problem or PR and get a structured response again.
4. BatchOps patterns course of many gadgets without delay on a schedule — issues like scanning each open dependency-update PR for merge conflicts, or flagging stale points throughout a complete repository in a single cross.

You need not memorize the complete taxonomy. What issues is recognizing that just about something you’d need automated suits one in all these shapes, and ranging from an current sample is far sooner than designing your individual from a clean web page.

# Reusing Workflows As an alternative of Writing Your Personal

 
You do not have to begin from zero each time. GitHub Subsequent maintains a public catalogue known as agentics with ready-made workflows protecting triage, compliance checks, reporting, and extra. You’ll be able to pull one straight into your repository:

# Imports a pre-built workflow from GitHub Subsequent's public catalogue
# and walks you thru configuring it interactively
gh aw add-wizard githubnext/agentics/daily-repo-status

For a non-interactive setup, gh aw add works the identical means and allows you to pin a particular model. While you import a workflow this manner, the CLI data a supply: worth within the frontmatter, which is how gh aw replace later is aware of the place to drag upstream modifications from.

Two issues value being cautious about right here. First, solely import workflows from sources you really belief and have reviewed, because you’re successfully giving an AI agent an outlined however actual slice of entry to your repository primarily based on another person’s directions. Second, workflows marked non-public: true of their supply repo cannot be imported elsewhere in any respect, so do not anticipate each inner staff’s workflow catalogue to be reusable outdoors its personal org.

# What’s Genuinely Nonetheless Tough

 
It will be dishonest to jot down a getting-started information for a public preview characteristic and faux every thing is polished. Just a few issues are value understanding entering into, primarily based on actual hands-on accounts from builders who’ve really run this in production-adjacent repos, together with an in depth write-up from developer Hector Flores documenting 4 workflows he constructed and ran.

Debugging remains to be opaque in locations. When an agent makes a classification you did not anticipate, your solely actual window into why is customary GitHub Actions logs, not a structured reasoning hint explaining the choice. That is workable for now, but it surely’s the very first thing energy customers ask for.

There is no real-time price visibility per workflow run. Every execution consumes AI tokens towards your engine’s billing, and when you can verify total utilization after the actual fact, there is no per-workflow estimate to assist a staff set a funds earlier than turning one thing on throughout dozens of repositories.

The .lock.yml compilation step seems like scaffolding reasonably than a everlasting a part of the design. It really works reliably, however the two-file sample (Markdown supply plus generated lock file) reads like one thing that can finally get absorbed straight into the platform, the place you push a .md file and GitHub compiles it natively and not using a separate CLI step.

None of that ought to cease you from attempting it. It ought to simply set your expectations appropriately: this can be a fast-moving public preview, not a completed product, and the components of it that can matter most in a 12 months — the safe-outputs contract and the layered safety mannequin — are already the strongest a part of what exists right this moment.

# The place This Matches Subsequent to Different Copilot Instruments

 
It is simple to conflate this with different issues GitHub already ships below the Copilot identify, so here is a fast side-by-side to maintain them straight.

None of those three exchange one another. A wholesome setup normally runs all three without delay: customized Actions for deterministic checks like linting and checks, the cloud coding agent for while you need to hand off a particular characteristic, and Agentic Workflows for the recurring judgment calls that do not match a set rule but additionally do not want an individual to kick them off each time.

# Closing Ideas

 
Probably the most helpful means to consider GitHub Agentic Workflows is not “AI writes my YAML now.” It is that you could lastly encode judgment calls into automation as an alternative of solely guidelines. A conventional Motion can implement “each PR touching src/auth/ wants a safety evaluate.” An agentic workflow can act on “flag something that appears security-sensitive and route it appropriately” — which is a genuinely totally different and tougher drawback that used to require an individual paying consideration each single time.

If you happen to’re attempting this for the primary time, begin with difficulty triage. It is the best sample; the safe-outputs contract is simple to cause about with solely a remark and a label at stake, and you will see it work or fail inside minutes of opening a check difficulty. As soon as that clicks, the soar to scheduled experiences, PR evaluate, and documentation maintenance is a a lot smaller leap than it seems to be like from the surface.

Learn by way of the official quickstart information for essentially the most present setup steps, and in the event you construct one thing value sharing again, the neighborhood dialogue is the place GitHub is actively gathering suggestions whereas the characteristic remains to be in preview.
 
 

Shittu Olumide is a software program engineer and technical author captivated with leveraging cutting-edge applied sciences to craft compelling narratives, with a eager eye for element and a knack for simplifying complicated ideas. You may as well discover Shittu on Twitter.