GitHub Agentic Workflows hit general availability on October 28. The feature lets you describe CI automation in plain Markdown, compile it into a real GitHub Actions workflow, and have an AI coding agent execute it on event triggers. No manual steps, no YAML expertise required. It is now open to all Free, Team, and Enterprise plans on github.com with no waitlist.
Write in Markdown, Compile to Actions #
The core mechanic is simple to describe and genuinely novel to use. You author a file at .github/workflows/name.md with YAML frontmatter that configures triggers, permissions, and the AI engine, and a plain-English body that tells the agent what to do. Running gh aw compile validates it, applies security hardening, and produces a companion .github/workflows/name.lock.yml file that GitHub Actions actually executes.
One useful detail: the Markdown body is loaded at runtime, not at compile time. You only need to recompile when you change frontmatter configuration. Tweak your instructions and push with no recompilation required.
A minimal issue-triage workflow source file looks like this:
on:
issues:
types: [opened]
permissions:
issues: write
engine: copilot
max-ai-credits: 200
When a new issue is opened, classify it by type (bug, feature, docs, question)
and apply the matching label. If it is a bug, check for duplicates in the last
90 days and link them.
That is the entire source file. The compiler runs five phases (parse, validate, job construction, dependency resolution, YAML generation) and hands off to Actions. The official GitHub Docs cover the full frontmatter schema.
The Security Model Is Layered on Purpose #
GitHub did not design a trust-the-agent permission model. It designed six distinct security layers, each handling a different threat surface.
Workflows start with read-only repository permissions. Write operations must be explicitly declared in frontmatter and are handled via Safe Outputs. The agent proposes changes, which are buffered, validated, and applied in a separate job with scoped permissions. The agent never writes directly.
Network egress runs through the Agent Workflow Firewall, a domain-allowlist proxy that prevents the agent from calling arbitrary external services. Agents also run inside a sandboxed container with integrity filtering to screen against prompt injection attacks.
New at GA: agents can now run inside Cloud Hypervisor or NVX micro-VMs, with enclaves that prevent data leaks in cross-repository workflows. This isolation level was not available during the preview period.
Budget Controls: AI Credits Keep Costs Predictable #
GitHub prices inference through AI Credits (AIC), where 1 AIC equals $0.01. The default cap is 1,000 AIC ($10) per run, set with the max-ai-credits frontmatter key. The agent stops when it hits the cap with no runaway inference bills.
Enterprise plans set their own defaults: 5,000 AIC per day, 400 AIC per threat-detection run, and a 20-minute agent step timeout, all overridable. Total cost is GitHub Actions minutes plus engine inference. If you use Copilot, inference bills through GitHub. If you use Claude Code or Codex, it bills through Anthropic or OpenAI directly.
Bring Your Own Agent #
The default engine is GitHub Copilot CLI, which requires a Copilot licence. But the engine frontmatter key accepts Claude Code, OpenAI Codex, Google Gemini, and Pi as alternatives. Your existing billing relationship with Anthropic or OpenAI applies. GitHub Agentic Workflows is a runner layer, not a model lock-in.
What It Is Actually Good For #
The tasks that work well are reasoning-heavy but bounded: issue triage and labeling, CI failure investigation, documentation sync, test coverage improvement, and repository status reports. Franck Nijhof, lead maintainer of Home Assistant, has already deployed it for issue analysis: “Building workflows that analyze issues and surface what matters is the kind of judgment amplification that actually helps maintainers.”
What does not work well yet: package dependency management. Community reports describe agents string-editing lockfiles and hallucinating version numbers instead of calling the proper package tools. Refactoring tasks run slowly. These are worth knowing before you scope your first workflow.
The InfoQ analysis puts it plainly: treat these like production automation with narrow jobs, scoped tokens, reviewable outputs, explicit owners, budget caps, and boring defaults. GitHub Agentic Workflows is not an autonomous developer. It is narrow-job automation with AI reasoning baked in. That is a genuinely useful thing and a meaningfully different thing from how it tends to get marketed.