Getting Began with GitHub Agentic Workflows

# Introducing GitHub’s Agentic Workflows

 
It is 9 AM on a Monday, and forty-three new points are sitting within the backlog. Some are actual bugs. Some are duplicate characteristic requests. A pair are simply somebody venting a couple of typo. Whoever is on triage obligation this week goes to spend the primary two hours of their day studying, labelling, and replying to all of them earlier than they’ll contact something they really deliberate to construct.

That is the precise sort of work GitHub constructed Agentic Workflows to take off your plate. On June 11, 2026, GitHub moved Agentic Workflows into public preview, giving each repository the power to run coding brokers inside GitHub Actions to deal with precisely this sort of reasoning-heavy, repetitive work. Not code completion. Not a chat sidebar. A scheduled or event-triggered agent that reads a difficulty, a pull request, or every week’s value of commits, and does one thing helpful with what it finds.

This text walks by means of what the characteristic really is, why the safety mannequin issues greater than the pitch-deck model of it, and how one can write, compile, and run your first workflow in the present day. By the top, you will have a working triage workflow of your personal and a transparent sense of what is nonetheless a bit tough across the edges.

# What Are GitHub Agentic Workflows?

 
Strip away the advertising language, and the thought is pretty easy. You write a Markdown file that lives in .github/workflows/. The highest of that file has a small block of YAML frontmatter describing when the workflow runs, what it is allowed to the touch, and which AI engine powers it. Under the frontmatter, you write plain-English directions describing what you need the agent to do.

A command-line interface (CLI) device referred to as gh-aw reads that Markdown file and compiles it right into a .lock.yml file, which is a totally bizarre GitHub Actions workflow. That is the half value sitting with for a second: there isn’t any separate agent runtime bolted onto your repository. It reuses your present runners, your present department safety guidelines, and your present coverage constraints, as a result of beneath the pure language, it is simply Actions.

The challenge is constructed by GitHub Subsequent and Microsoft Analysis, and it at the moment helps 4 AI engines out of the field: GitHub Copilot, Anthropic’s Claude, OpenAI Codex, and Google Gemini, with the choice to plug in a customized processor if none of these match. Copilot is the default engine, and in case your group already pays for a Copilot plan, workflow runs can invoice on to that group as a substitute of requiring you to handle a separate API key.

It additionally sits inside an even bigger concept GitHub calls Steady AI, which is actually simply the apply of making use of AI systematically throughout the software program lifecycle as a substitute of 1 immediate at a time. Agentic Workflows is the mechanism for doing that on a schedule or in response to repository occasions, moderately than solely when an individual occurs to be sitting at their keyboard asking Copilot a query.

It is also value being clear about what this isn’t. It is not the identical factor as Copilot’s cloud coding agent, which you kick off manually from a difficulty or a pull request whenever you need an agent to implement one thing particular for you proper now. Agentic Workflows is nearer to a standing coverage: “each Monday, summarize the week’s problem exercise” or “each time a PR opens, evaluate it for safety issues.” One is a process you hand off. The opposite is a behavior you construct into the repository itself.

# Why This Is Price Paying Consideration To

 
GitHub does not sometimes publish adoption numbers this early in a preview, so the truth that they connected named buyer quotes to the launch says one thing about how far alongside the interior testing already was.

Carvana informed GitHub the pliability and built-in controls gave their engineering workforce sufficient confidence to run agentic workflows throughout genuinely complicated methods, together with adjustments that contact multiple repository at a time, in accordance with the official changelog. Marks & Spencer described an identical story from a distinct angle: their builders had been dropping actual dash hours to the boring stuff — problem triage, dependency upkeep, vulnerability remediation, and routine evaluate — and constructing a shared catalogue of reusable agentic workflows let groups decide up that automation throughout any repository with out reinventing it every time.

Hud.io made some extent that is straightforward to overlook in case you’re solely skimming the characteristic checklist: getting an agent to open a pull request was by no means the exhausting a part of this. Trusting the output sufficient to truly merge it’s. That is actually the entire thesis behind the safety design coated within the subsequent part.

Here is the form of the characteristic because it stands in the present day, pulled immediately from GitHub’s personal numbers web page:

# The Safety Mannequin Is the Actual Story Right here

 
Most “AI does your DevOps now” pitches skip straight previous the apparent query: what occurs when the agent will get it mistaken, or worse, will get manipulated by one thing hostile sitting inside a difficulty remark or a file within the repo. Immediate injection by means of repository content material is a recognized threat with any agent that reads untrusted textual content, and GitHub constructed 5 layers particularly to comprise that, moderately than faux it could possibly’t occur.

1. Learn-only tokens: The agent’s GitHub token is scoped to read-only entry by default. If it tries to push code, open a PR, or delete a file immediately, the token itself does not enable it, no matter what the agent decides to aim.
2. Zero secrets and techniques within the agent course of: The method really operating the AI mannequin by no means receives write tokens, API keys, or credentials of any form. These stay solely in a separate job that runs after the agent has already completed and its proposed output has been checked. If the agent is compromised mid-run, there’s nothing in its attain value stealing.
3. A sandboxed container behind a community firewall: The agent executes inside an remoted container, and all outbound visitors is routed by means of what GitHub calls the Agent Workflow Firewall, a Squid proxy imposing an specific allowlist of domains. Something outdoors that allowlist will get dropped on the kernel degree, so a compromised agent has no path to quietly telephone house together with your information.
4. Secure outputs: That is the half value understanding correctly, as a result of it is the mechanism that makes the remainder of the mannequin work in apply. The agent cannot write to your repository immediately in any respect. As a substitute, it produces a structured description of what it desires to do — one thing like “open a difficulty with this title and this physique.” A separate job with narrowly scoped write permissions reads that request and applies solely what you have explicitly allowed within the workflow’s frontmatter: a tough cap of 1 problem per run, a required title prefix, particular label restrictions, no matter you determine. The agent proposes. A gated, deterministic job disposes.
5. Agentic menace detection: Earlier than any of that output really lands in your repo, a devoted threat-detection job runs its personal AI-powered scan throughout the proposed adjustments, checking for injection makes an attempt, leaked credentials, or suspicious code patterns. If one thing appears mistaken, the entire run fails, and nothing will get written.

Put collectively, the agent can learn virtually something in your repository, however it could possibly solely ever act by means of a slim, auditable contract you outline your self. That is a meaningfully totally different belief mannequin from putting in a third-party GitHub Motion and granting it broad write permissions on religion.

# What You Want Earlier than You Begin

 
You do not want a lot to get going, however every of those issues:

An account with one of many supported AI engines: GitHub Copilot, Anthropic Claude, OpenAI Codex, or Google Gemini. A GitHub repository the place you’ve got write entry. GitHub Actions should be enabled on that repository. And the GitHub CLI, model 2.0.0 or later, should already be authenticated in your machine.

Verify your CLI model with gh --version, and if it’s essential to authenticate, run:

# Logs your native gh CLI into GitHub with the 2 scopes
# agentic workflows want: repo entry and workflow write entry
gh auth login --scopes repo,workflow

As soon as that is executed, set up the extension that does the precise Markdown-to-YAML compilation:

# Installs the gh-aw extension into your present GitHub CLI
gh extension set up github/gh-aw

For those who’re already on GitHub CLI 2.90.0 or newer, operating any gh aw command will supply to put in this mechanically the primary time you utilize it, so you will not hit a missing-extension error out of nowhere.

# Setting Up Authentication

 
That is the one step that journeys up virtually everybody the primary time, so it is value slowing down right here.

For those who’re utilizing GitHub Copilot inside a repository owned by a company with a Copilot plan, you need the built-in GITHUB_TOKEN method. It payments utilization straight to your group and means no one has to babysit a private entry token (PAT) as a repo secret. Your group admin must allow “Enable use of Copilot CLI billed to the group” underneath Copilot coverage settings first. As soon as that is on, all you want in your workflow frontmatter is:

permissions:
  contents: learn
  copilot-requests: write   # routes Copilot billing by means of the org, not a private token

This can be a genuinely current change value calling out immediately: as of the identical June 11, 2026 launch, GitHub Agentic Workflows not requires a PAT in any respect for this path. Earlier hands-on writeups from the technical preview interval in February 2026 describe producing a fine-grained PAT with Copilot Requests permission and manually including it as a COPILOT_GITHUB_TOKEN secret. That step nonetheless exists as an possibility for private repositories or for third-party engines like Claude or Codex that want their very own API key saved as a secret, however in case you’re operating Copilot inside an org-owned repo, you’ll be able to skip the token dance fully now.

For something that does want a saved secret (private repos, or Claude and Codex as your engine), you add it as soon as by means of your repository’s Actions secrets and techniques, both within the GitHub UI or with gh aw secrets and techniques set from the CLI.

# Writing Your First Workflow

 
Let’s construct one thing you’d really need operating in an actual repository: an agent that triages new points the second they’re opened, classifies them, labels them, and posts a brief, helpful response.

You can write this file by hand, however a greater first expertise is to let a coding agent scaffold it for you. Run this as soon as per repository to set that up:

# Provides abilities, directions, and a helper agent to this repo
# so any coding agent you utilize afterward understands how one can
# writer and edit agentic workflows accurately
gh aw init

Then, from inside your coding agent of selection (Copilot CLI or VS Code agent mode each work), you’d immediate one thing like: create a brand new workflow that triages newly opened points, classifies them by sort and precedence, applies labels, and posts an acknowledgement remark. The agent handles the file creation and the primary compile move for you.

Nevertheless it helps to truly learn and perceive the file it produces, so this is a hand-written model you’ll be able to drop straight into .github/workflows/issue-triage.md:

---
description: Classify new points, apply labels, and put up a brief response
on:
  points:
    varieties: [opened]        # solely fires when a brand-new problem is created

permissions:
  contents: learn            # agent can learn repo information for context
  points: learn               # agent can learn the difficulty itself

community: defaults            # outbound visitors restricted to the default allowlist

instruments:
  github:
    toolsets: [issues]       # solely issue-related GitHub instruments are uncovered

safe-outputs:
  add-label:
    max: 3                   # by no means apply greater than 3 labels in a single run
  add-comment:
    max: 1                   # precisely one acknowledgment remark, by no means extra
---

# Concern Triage Agent

When a brand new problem is opened, learn its title, physique, and any code
snippets included in it.

Classify the difficulty as one among: bug, characteristic request, query, or
documentation hole.

Assess precedence as important, excessive, medium, or low, primarily based on how
a lot of the system the difficulty impacts and whether or not it blocks different
customers.

Apply labels that mirror each the kind and the precedence.

Publish one quick remark thanking the reporter, restating your
classification in plain language, and letting them know a
maintainer will observe up if it is excessive precedence or above.

Preserve the remark underneath 4 sentences. Do not speculate a couple of
repair. Simply acknowledge and route.

What this file is definitely doing, line by line: The on block means this solely runs when somebody opens a brand new problem, not on edits or feedback, which retains operating low-cost and predictable. The permissions block is intentionally slim — read-only on each repo contents and points — as a result of the agent’s job right here is to look at and classify, to not modify something immediately. community: defaults retains outbound calls restricted to GitHub’s commonplace allowlist moderately than opening the container as much as the broader web. The instruments block scopes down which GitHub API floor the agent even has entry to, so it could possibly’t, say, begin searching pull requests when all it wants is problem information. And the safe-outputs block is the precise belief boundary mentioned earlier on this article: the agent can recommend as much as three labels and precisely one remark, and nothing else, it doesn’t matter what it decides mid-run can be a good suggestion.

As soon as the file is saved, compile it:

# Reads the Markdown file and generates the actual GitHub Actions
# YAML (issue-triage.lock.yml) that Actions will really run
gh aw compile

Commit each the .md file and the generated .lock.yml file collectively. Sure, each information go into model management. The Markdown is your supply of fact, and the lock file is what Actions executes — related in spirit to how a bundle lock file sits alongside a manifest.

Push, open a check problem, and watch the Actions tab. Or set off it manually with out ready for an actual problem:

# Manually kicks off a workflow run by identify, helpful for testing
# earlier than you depend on the actual occasion set off
gh aw run issue-triage

# Understanding Each Subject within the Frontmatter

 
The instance above solely used a handful of fields, however it helps to know the total form of what is out there earlier than you begin writing your personal workflows from scratch.

The total reference lives on the gh-aw frontmatter documentation, and it is value bookmarking when you begin writing workflows that transcend a single set off.

# Widespread Patterns Price Understanding

 
GitHub paperwork greater than eighteen recurring design patterns for these workflows, and most actual utilization clusters round a handful of them.

1. IssueOps is precisely what the triage instance above demonstrates: an agent that reacts to problem occasions and manages the lifecycle of particular person points.
2. DailyOps or WeeklyOps patterns run on a schedule moderately than an occasion, producing digests, reviews, or well being checks. GitHub’s personal documentation instance for it is a weekly problem exercise report: an agent that evaluations the final seven days of problem exercise and opens a single abstract problem overlaying totals, recurring themes, and a brief checklist of things that also want consideration, utilizing nothing greater than a schedule set off and a create-issue secure output capped at one per run.
3. ChatOps patterns reply to feedback or mentions, letting a maintainer sort one thing like "@bot summarize this thread" immediately into a difficulty or PR and get a structured response again.
4. BatchOps patterns course of many gadgets directly on a schedule — issues like scanning each open dependency-update PR for merge conflicts, or flagging stale points throughout a whole repository in a single move.

You need not memorize the total taxonomy. What issues is recognizing that nearly something you’d need automated matches one among these shapes, and ranging from an present sample is far sooner than designing your personal from a clean web page.

# Reusing Workflows As a substitute of Writing Your Personal

 
You do not have to start out from zero each time. GitHub Subsequent maintains a public catalogue referred to as agentics with ready-made workflows overlaying triage, compliance checks, reporting, and extra. You’ll be able to pull one immediately into your repository:

# Imports a pre-built workflow from GitHub Subsequent's public catalogue
# and walks you thru configuring it interactively
gh aw add-wizard githubnext/agentics/daily-repo-status

For a non-interactive setup, gh aw add works the identical manner and allows you to pin a selected model. While you import a workflow this manner, the CLI information a supply: worth within the frontmatter, which is how gh aw replace later is aware of the place to tug upstream adjustments from.

Two issues value being cautious about right here. First, solely import workflows from sources you really belief and have reviewed, because you’re successfully giving an AI agent an outlined however actual slice of entry to your repository primarily based on another person’s directions. Second, workflows marked personal: true of their supply repo cannot be imported elsewhere in any respect, so do not anticipate each inner workforce’s workflow catalogue to be reusable outdoors its personal org.

# What’s Genuinely Nonetheless Tough

 
It might be dishonest to write down a getting-started information for a public preview characteristic and faux all the pieces is polished. A couple of issues are value realizing stepping into, primarily based on actual hands-on accounts from builders who’ve really run this in production-adjacent repos, together with an in depth write-up from developer Hector Flores documenting 4 workflows he constructed and ran.

Debugging continues to be opaque in locations. When an agent makes a classification you did not anticipate, your solely actual window into why is commonplace GitHub Actions logs, not a structured reasoning hint explaining the choice. That is workable for now, however it’s the very first thing energy customers ask for.

There is no real-time value visibility per workflow run. Every execution consumes AI tokens in opposition to your engine’s billing, and when you can examine total utilization after the very fact, there isn’t any per-workflow estimate to assist a workforce set a price range earlier than turning one thing on throughout dozens of repositories.

The .lock.yml compilation step appears like scaffolding moderately than a everlasting a part of the design. It really works reliably, however the two-file sample (Markdown supply plus generated lock file) reads like one thing that can ultimately get absorbed immediately into the platform, the place you push a .md file and GitHub compiles it natively and not using a separate CLI step.

None of that ought to cease you from making an attempt it. It ought to simply set your expectations accurately: it is a fast-moving public preview, not a completed product, and the elements of it that can matter most in a yr — the safe-outputs contract and the layered safety mannequin — are already the strongest a part of what exists in the present day.

# The place This Suits Subsequent to Different Copilot Instruments

 
It is simple to conflate this with different issues GitHub already ships underneath the Copilot identify, so this is a fast side-by-side to maintain them straight.

None of those three substitute one another. A wholesome setup often runs all three directly: customized Actions for deterministic checks like linting and exams, the cloud coding agent for whenever you need to hand off a selected characteristic, and Agentic Workflows for the recurring judgment calls that do not match a set rule but in addition do not want an individual to kick them off each time.

# Closing Ideas

 
Essentially the most helpful manner to consider GitHub Agentic Workflows is not “AI writes my YAML now.” It is which you could lastly encode judgment calls into automation as a substitute of solely guidelines. A standard Motion can implement “each PR touching src/auth/ wants a safety evaluate.” An agentic workflow can act on “flag something that appears security-sensitive and route it appropriately” — which is a genuinely totally different and tougher downside that used to require an individual paying consideration each single time.

For those who’re making an attempt this for the primary time, begin with problem triage. It is the best sample; the safe-outputs contract is simple to cause about with solely a remark and a label at stake, and you will see it work or fail inside minutes of opening a check problem. As soon as that clicks, the leap to scheduled reviews, PR evaluate, and documentation maintenance is a a lot smaller leap than it appears like from the skin.

Learn by means of the official quickstart information for probably the most present setup steps, and in case you construct one thing value sharing again, the neighborhood dialogue is the place GitHub is actively accumulating suggestions whereas the characteristic continues to be in preview.
 
 

Shittu Olumide is a software program engineer and technical author obsessed with leveraging cutting-edge applied sciences to craft compelling narratives, with a eager eye for element and a knack for simplifying complicated ideas. It’s also possible to discover Shittu on Twitter.