GitHub Agentic Workflows is generally available: Markdown agents in Actions, read-only by default

GitHub announced on 28 October 2026 that GitHub Agentic Workflows, its way of running coding agents inside GitHub Actions from plain Markdown files, is now generally available on github.com for Free, Team and Enterprise plans. It matters because it moves "let an AI agent triage my issues or fix my failing CI" from an experiment into a supported feature with a defined security model, and because the safety design (read-only by default, no automatic merges) is a template other agent tools will be compared against.

Key points

• GitHub says Agentic Workflows is generally available on github.com for GitHub Free, Team and Enterprise as of 28 October 2026; it entered technical preview on 13 February 2026.
• You write the automation in Markdown, and the gh aw command-line extension compiles it into a standard GitHub Actions workflow file (.lock.yml).
• Workflows run with read-only permissions by default, and any write goes through pre-approved "safe outputs" such as opening an issue or a pull request.
• The default engine is GitHub Copilot CLI, which needs a Copilot licence; GitHub's docs also list Claude Code, OpenAI Codex and Gemini CLI, each needing its own API key stored as a repository secret.
• GitHub's announcement does not state specific prices or usage limits.

What happened

In its changelog entry of 28 October, GitHub described Agentic Workflows as an open source project from GitHub Next that runs coding agents in GitHub Actions for tasks that need reasoning rather than fixed scripting: issue triage, CI failure analysis, documentation updates and test writing. The release notes list a security model with several layers: agents respect integrity filter rules when reading GitHub content, run read-only by default, execute in a sandboxed container behind what GitHub calls the Agent Workflow Firewall, and have their proposed outputs validated. A separate threat detection job scans proposed changes before they are applied.

The GA release also adds newer isolation options (Cloud Hypervisor or NVX micro-VMs, and enclaves for cross-repository workflows), support for Actions Runner Controller with Docker-in-Docker, a choice of model provider per workflow, and model routing by task type and difficulty. A gh aw forecast command now covers threat detection credits and monthly ranges for AI credit spend, which is GitHub's answer to the obvious question of what an always-on agent will cost.

The announcement came during GitHub Universe 2026, alongside other agent news that we covered separately, including Copilot Fusion going generally available. In its Universe post GitHub also described "Copilot automations", a related cloud feature that can be started manually, on an event or on a schedule; the post does not mention Agentic Workflows by name, so we treat them as separate features.

Background

GitHub Actions has long let repositories run scripts on events such as a push or a new issue. The limit has been that a script does exactly what it was written to do. Tasks like "read this issue, work out which area it belongs to and label it" or "explain why this build failed" were awkward to express as rules.

On 13 February 2026 GitHub put Agentic Workflows into technical preview. The accompanying engineering post, by Don Syme and Peli de Halleux, framed the design around intent versus constraints: "The Markdown is the intent, but the trigger, permissions, tools, and allowed outputs are spelled out up front." Each workflow file has YAML frontmatter (trigger, permissions, tools, allowed outputs) followed by natural-language instructions. Running gh aw compile turns it into a .lock.yml file that Actions executes; both files live in .github/workflows.

That post also set the principle that pull requests are never merged automatically and that humans review and approve them. GitHub said the design uses defence in depth: sandboxed execution, tool allowlisting and network isolation, and argued that safe outputs are tighter than running a coding-agent CLI directly in ordinary YAML, which often grants more permissions than a task needs.

How it works

The path from idea to running workflow, as GitHub's tutorial describes it:

1. Install the GitHub CLI (version 2.0.0 or later) and authenticate with gh auth login --scopes repo,workflow.
2. Install the extension with gh extension install github/gh-aw.
3. In the repository, run gh aw init.
4. Start a coding-agent session and ask it to create the workflow using the agentic-workflows skill, for example a pull-request reviewer that checks the changes are tested.
5. Review the generated Markdown file and the compiled .lock.yml, then commit and push both.
6. Open or update a pull request. The workflow runs from the repository's Actions tab, and the example posts a review saying whether the changes include enough tests.

Credentials depend on the engine. According to the tutorial, Claude Code, OpenAI Codex and Gemini CLI need their API key stored as a repository secret (ANTHROPIC_API_KEY, OPENAI_API_KEY or GEMINI_API_KEY). Copilot CLI, the default, needs no secret in organisation-owned repositories if the workflow adds copilot-requests: write to its permissions; in personal repositories it needs a fine-grained personal access token with Copilot Requests set to read, stored as COPILOT_GITHUB_TOKEN.

Cost. In the February post, GitHub said that with default Copilot settings each run typically uses two premium requests: one for the agent's work and one for the safe-outputs guardrail check. That figure came from the preview period; the GA announcement does not restate it, so check your plan's current billing before scheduling many runs.

What it means

For maintainers and small teams. The most obvious uses are the chores nobody wants: first-pass issue triage, a daily status issue, a documentation update after an API change, a failing-test explanation attached to a pull request. Because output is limited to approved actions and a human merges, the worst case of a bad run is a poor comment or draft, not a bad deploy.

For security teams. Agent workflows in CI are an attractive target, because untrusted text (an issue body, a pull request description) ends up in a model's prompt while the job holds repository credentials. GitHub's answer is to remove credentials and write access from the agent step, filter what it can read, firewall its network and scan its output. Whether that holds up will be tested by researchers now that the feature is generally available. We recommend reviewing every permissions and safe-output entry in a compiled workflow as you would review any other privileged CI change, and keeping agent API keys in repository secrets, as GitHub's docs advise.

For the agent-tool market. GitHub is supporting rival agents (Claude Code, Codex, Gemini CLI) in the same workflow format as its own, while keeping Copilot as the default. That lowers the cost of switching engines, and puts pressure on each vendor to compete on quality and price per run.

What we don't know yet

• Price. The announcement names no price or usage limit, and the Copilot licence requirement for the default engine means costs depend on your plan.
• Preview label in docs. At the time of writing, the tutorial page we read does not say whether the feature is in preview or generally available, even though the changelog says GA. We rely on the changelog.
• Real-world security record. The isolation features are GitHub's claims; no independent assessment of the GA release was available to us.
• Enterprise controls. The notes say workflows reuse existing runner groups and policy constraints, but we did not find detail on organisation-level switches to disallow agent workflows.

What to watch next

Watch for independent security reviews of the safe-outputs and firewall design, any published pricing for threat detection credits, and whether the micro-VM and enclave options reach all plans. Also watch how Copilot automations and Agentic Workflows are positioned relative to each other, since GitHub currently presents both for similar jobs.

Sources

• GitHub changelog: GitHub Agentic Workflows generally available (28 Oct 2026)
• GitHub changelog: Agentic Workflows now in technical preview (13 Feb 2026)
• GitHub blog: Automate repository tasks with GitHub Agentic Workflows
• GitHub docs: Develop agentic workflows in GitHub Actions
• GitHub blog: GitHub Universe 2026, evolving every layer of the stack