Blog

Meet the Workflows: Security-related

Jan 13, 2026

Don Syme

Peli de Halleux

Mara Kiefer

Splendid! How great to have you back at Peli’s Agent Factory! Now, let me show you the guardian chamber - where the watchful protectors stand vigil!

In our previous post, we explored operations and release workflows that handle the critical process of shipping software - building, testing, generating release notes, and publishing. These workflows need to be rock-solid reliable because they represent the moment when our work reaches users.

But reliability alone isn’t enough - we also need security. When AI agents can access APIs, modify code, and interact with external services, security becomes paramount. How do we ensure agents only access authorized resources? How do we track vulnerabilities and enforce compliance deadlines? How do we prevent credential exposure? That’s where security and compliance workflows become our essential guardrails - the watchful guardians that let us sleep soundly at night.

Security-related Workflows

These agents are our security guards, keeping watch and enforcing the rules:

• Security Compliance - Runs vulnerability campaigns with deadline tracking
• Firewall - Tests network security and validates rules - 59 daily firewall report discussions, 5 smoke test issues
• Daily Secrets Analysis - Scans for exposed credentials (yes, it happens)
• Daily Malicious Code Scan - Reviews recent code changes for suspicious patterns
• Static Analysis Report - Daily security scans using zizmor, poutine, and actionlint - 57 analysis discussions plus 12 Zizmor security reports

Security Compliance manages vulnerability remediation campaigns with deadline tracking, ensuring security issues are addressed within defined SLAs - perfect for those “audit in 3 weeks” panic moments.

The Firewall workflow has created 59 daily firewall report discussions and 5 smoke test issues, validating that our agents can’t access unauthorized resources - for example, #6943 with the daily firewall analysis. It’s the bouncer that enforces network rules.

Daily Secrets Analysis scans for exposed credentials in commits and discussions, providing an automated security net against accidental secret exposure - catching those “oops, I committed my API key” moments before they become incidents.

Daily Malicious Code Scan reviews recent code changes for suspicious patterns, adding an automated defense layer against supply chain attacks.

Static Analysis Report has created 57 analysis discussions plus 12 Zizmor security reports, running comprehensive daily security audits using industry-standard tools - for example, #6973 with the latest static analysis findings and #3033 with a Zizmor security analysis. This shows how traditional security tools can be integrated into an AI agent workflow.

Using These Workflows

You can add these workflows to your own repository and remix them. Get going with our Quick Start, then run one of the following:

Security Compliance:

gh aw add-wizard https://github.com/github/gh-aw/blob/main/.github/workflows/security-compliance.md

Firewall:

gh aw add-wizard https://github.com/github/gh-aw/blob/main/.github/workflows/firewall.md

Daily Secrets Analysis:

gh aw add-wizard https://github.com/github/gh-aw/blob/main/.github/workflows/daily-secrets-analysis.md

Daily Malicious Code Scan:

gh aw add-wizard https://github.com/githubnext/agentics/blob/main/workflows/daily-malicious-code-scan.md

Static Analysis Report:

gh aw add-wizard https://github.com/github/gh-aw/blob/main/.github/workflows/static-analysis-report.md

Then edit and remix the workflow specifications to meet your needs, regenerate the lock file using gh aw compile, and push to your repository. See our Quick Start for further installation and setup instructions.

You can also create your own workflows.

Learn More

• GitHub Agentic Workflows - The technology behind the workflows
• Quick Start - How to write and compile workflows

Next Up: Teamwork & Culture Workflows

After all this serious talk, let’s explore the fun side: agents that bring joy and build team culture.

Continue reading: Teamwork & Culture Workflows →

---

This is part 11 of a 19-part series exploring the workflows in Peli’s Agent Factory.

Meet the Workflows: Operations & Release

Jan 13, 2026

Don Syme

Peli de Halleux

Mara Kiefer

Ah! Right this way to our next chamber in Peli’s Agent Factory! The chamber where our AI agents enhance the magical moment of shipping software.

In our previous post, we explored metrics and analytics workflows - the agents that monitor other agents, turning raw activity data into actionable insights.

Operations & Release Workflows

The agents that help us actually ship software:

• Changeset - Manages version bumps and changelog entries for releases - 22 merged PRs out of 28 proposed (78% merge rate)
• Daily Workflow Updater - Keeps GitHub Actions and dependencies current

Shipping software is stressful enough without worrying about whether you formatted your release notes correctly.

Changeset Generator has contributed 22 merged PRs out of 28 proposed (78% merge rate), automating version bumps and changelog generation for every release. It analyzes commits since the last release, determines the appropriate version bump (major, minor, patch), and updates the changelog accordingly.

Daily Workflow Updater keeps GitHub Actions and dependencies current, ensuring workflows don’t fall behind on security patches or new features.

Using These Workflows

You can add these workflows to your own repository and remix them. Get going with our Quick Start, then run one of the following:

Changeset:

gh aw add-wizard https://github.com/github/gh-aw/blob/v0.45.5/.github/workflows/changeset.md

Then edit and remix the workflow specifications to meet your needs, regenerate the lock file using gh aw compile, and push to your repository. See our Quick Start for further installation and setup instructions.

You can also create your own workflows.

Learn More

• GitHub Agentic Workflows - The technology behind the workflows
• Quick Start - How to write and compile workflows

Next Up: Security-related Workflows

After all this focus on shipping, we need to talk about the guardrails: how do we ensure these powerful agents operate safely?

Continue reading: Security-related Workflows →

---

This is part 10 of a 19-part series exploring the workflows in Peli’s Agent Factory.

Meet the Workflows: Metrics & Analytics

Jan 13, 2026

Don Syme

Peli de Halleux

Mara Kiefer

Excellent journey! Now it’s time to plunge into the observatory - the nerve center of Peli’s Agent Factory!

In our previous post, we explored quality and hygiene workflows - the vigilant caretakers that investigate failed CI runs, detect schema drift, and catch breaking changes before users do. These workflows maintain codebase health by spotting problems before they escalate.

When you’re running dozens of AI agents, how do you know if they’re actually working well? How do you spot performance issues, cost problems, or quality degradation? That’s where metrics and analytics workflows come in - they’re the agents that monitor other agents. The aim is to turn raw activity data into actionable insights.

Metrics & Analytics Workflows

Let’s take a look at these three workflows:

• Metrics Collector - Tracks daily performance across the entire agent ecosystem
• Portfolio Analyst - Identifies cost reduction opportunities
• Audit Workflows - A meta-agent that audits all the other agents’ runs

The Metrics Collector has created 41 daily metrics discussions tracking performance across the agent ecosystem - for example, #6986 with the daily code metrics report. It became our central nervous system, gathering performance data that feeds into higher-level orchestrators.

Portfolio Analyst has created 7 portfolio analysis discussions identifying cost reduction opportunities and token optimization patterns - for example, #6499 with a weekly portfolio analysis. The workflow has identified workflows that were costing us money unnecessarily (turns out some agents were way too chatty with their LLM calls).

Audit Workflows is our most prolific discussion-creating agent with 93 audit report discussions and 9 issues, acting as a meta-agent that analyzes logs, costs, errors, and success patterns across all other workflow runs. Four of its issues led to PRs by downstream agents.

Observability isn’t optional when you’re running dozens of AI agents - it’s the difference between a well-oiled machine and an expensive black box.

Using These Workflows

You can add these workflows to your own repository and remix them. Get going with our Quick Start, then run one of the following:

Metrics Collector:

gh aw add-wizard https://github.com/github/gh-aw/blob/v0.45.5/.github/workflows/metrics-collector.md

Portfolio Analyst:

gh aw add-wizard https://github.com/github/gh-aw/blob/v0.45.5/.github/workflows/portfolio-analyst.md

Audit Workflows:

gh aw add-wizard https://github.com/github/gh-aw/blob/v0.45.5/.github/workflows/audit-workflows.md

Then edit and remix the workflow specifications to meet your needs, regenerate the lock file using gh aw compile, and push to your repository. See our Quick Start for further installation and setup instructions.

You can also create your own workflows.

Learn More

• GitHub Agentic Workflows - The technology behind the workflows
• Quick Start - How to write and compile workflows

Next Up: Operations & Release Workflows

Now that we can measure and optimize our agent ecosystem, let’s talk about the moment of truth: actually shipping software to users.

Continue reading: Operations & Release Workflows →

---

This is part 9 of a 19-part series exploring the workflows in Peli’s Agent Factory.

Meet the Workflows: Fault Investigation

Jan 13, 2026

Don Syme

Peli de Halleux

Mara Kiefer

Ah, splendid! Welcome back to Peli’s Agent Factory! Come, let me show you the chamber where vigilant caretakers investigate faults before they escalate!

In our previous post, we explored issue and PR management workflows.

Now let’s shift from collaboration ceremony to fault investigation.

While issue workflows help us handle what comes in, fault investigation workflows act as vigilant caretakers - spotting problems before they escalate and keeping our codebase healthy. These are the agents that investigate failed CI runs, detect schema drift, and catch breaking changes before users do.

Fault Investigation Workflows

These are our diligent caretakers - the agents that spot problems before they become bigger problems:

• CI Doctor - Investigates failed workflows and opens diagnostic issues - 9 merged PRs out of 13 proposed (69% merge rate)
• Schema Consistency Checker - Detects when schemas, code, and docs drift apart - 55 analysis discussions created
• Breaking Change Checker - Watches for changes that might break things for users - creates alert issues

The CI Doctor (also known as “CI Failure Doctor”) was one of our most important workflows. Instead of drowning in CI failure notifications, we now get timely, investigated failures with actual diagnostic insights. The agent doesn’t just tell us something broke - it analyzes logs, identifies patterns, searches for similar past issues, and even suggests fixes - even before the human has read the failure notification. CI Failure Doctor has contributed 9 merged PRs out of 13 proposed (69% merge rate), including fixes like adding Go module download pre-flight checks and adding retry logic to prevent proxy 403 failures. We learned that agents excel at the tedious investigation work that humans find draining.

The Schema Consistency Checker has created 55 analysis discussions examining schema drift between JSON schemas, Go structs, and documentation - for example, #7020 analyzing conditional logic consistency across the codebase. It caught drift that would have taken us days to notice manually.

Breaking Change Checker is a newer workflow that monitors for backward-incompatible changes and creates alert issues (e.g., #14113 flagging CLI version updates) before they reach production.

These “hygiene” workflows became our first line of defense, catching issues before they reached users.

The CI Doctor has inspired a growing range of similar workflows inside GitHub, where agents proactively do depth investigations of site incidents and failures. This is the future of operational excellence: AI agents kicking in immediately to do depth investigation, for faster organizational response.

Using These Workflows

You can add these workflows to your own repository and remix them. Get going with our Quick Start, then run one of the following:

CI Doctor:

gh aw add-wizard https://github.com/githubnext/agentics/blob/main/workflows/ci-doctor.md

Schema Consistency Checker:

gh aw add-wizard https://github.com/github/gh-aw/blob/main/.github/workflows/schema-consistency-checker.md

Breaking Change Checker:

gh aw add-wizard https://github.com/github/gh-aw/blob/main/.github/workflows/breaking-change-checker.md

Then edit and remix the workflow specifications to meet your needs, regenerate the lock file using gh aw compile, and push to your repository. See our Quick Start for further installation and setup instructions.

You can also create your own workflows.

Learn More

• GitHub Agentic Workflows - The technology behind the workflows
• Quick Start - How to write and compile workflows

Next Up: Metrics & Analytics Workflows

Next up, we look at workflows which help us understand if the agent collection as a whole is working well That’s where metrics and analytics workflows come in.

Continue reading: Metrics & Analytics Workflows →

---

This is part 8 of a 19-part series exploring the workflows in Peli’s Agent Factory.

Meet the Workflows: Issue & PR Management

Jan 13, 2026

Don Syme

Peli de Halleux

Mara Kiefer

Ah! Let’s discuss the art of managing issues and pull requests at Peli’s Agent Factory! A most delicious topic indeed!

In our previous post, we explored documentation and content workflows - agents that maintain glossaries, technical docs, slide decks, and blog content. We learned how we took a heterogeneous approach to documentation agents - some workflows generate content, others maintain it, and still others validate it.

Now let’s talk about the daily rituals of software development: managing issues and pull requests. GitHub provides excellent primitives for collaboration, but there’s ceremony involved - linking related issues, merging main into PR branches, assigning work, closing completed sub-issues, optimizing templates. These are small papercuts individually, but they can add up to significant friction.

Issue & PR Management Workflows

These agents enhance issue and pull request workflows:

• Issue Arborist - Links related issues as sub-issues - 77 discussion reports and 18 parent issues created
• Issue Monster - Assigns issues to the asynchronous GitHub Copilot coding agent one at a time - task dispatcher for the whole system
• Mergefest - Automatically merges main branch into PR branches - orchestrator workflow
• Sub Issue Closer - Closes completed sub-issues automatically - orchestrator workflow

The Issue Arborist is an organizational workflow that has created 77 discussion reports (titled “[Issue Arborist] Issue Arborist Report”) and 18 parent issues to group related sub-issues. It keeps the issue tracker organized by automatically linking related issues, building a dependency tree we’d never maintain manually. For example, #12037 grouped engine documentation updates.

The Issue Monster is the task dispatcher - it assigns issues to the GitHub platform’s asynchronous Copilot coding agent one at a time. It doesn’t create PRs itself, but enables every other agent’s work by feeding them tasks. This prevents the chaos of parallel work on the same codebase.

Mergefest is an orchestrator workflow that automatically merges main into PR branches, keeping long-lived PRs up to date without manual intervention. It eliminates the “please merge main” dance.

Sub Issue Closer automatically closes completed sub-issues when their parent issue is resolved, keeping the issue tracker clean.

Issue and PR management workflows don’t replace GitHub’s features; they enhance them, removing ceremony and making collaboration feel smoother.

Using These Workflows

You can add these workflows to your own repository and remix them. Get going with our Quick Start, then run one of the following:

Issue Arborist:

gh aw add-wizard https://github.com/githubnext/agentics/blob/main/workflows/issue-arborist.md

Issue Monster:

gh aw add-wizard https://github.com/github/gh-aw/blob/main/.github/workflows/issue-monster.md

Mergefest:

gh aw add-wizard https://github.com/github/gh-aw/blob/main/.github/workflows/mergefest.md

Sub Issue Closer:

gh aw add-wizard https://github.com/githubnext/agentics/blob/main/workflows/sub-issue-closer.md

Then edit and remix the workflow specifications to meet your needs, regenerate the lock file using gh aw compile, and push to your repository. See our Quick Start for further installation and setup instructions.

You can also create your own workflows.

Learn More

• GitHub Agentic Workflows - The technology behind the workflows
• Quick Start - How to write and compile workflows

Next Up: Fault Investigation Workflows

Next up we look at agents that maintain codebase health - spotting problems before they escalate.

Continue reading: Fault Investigation Workflows →

---

This is part 7 of a 19-part series exploring the workflows in Peli’s Agent Factory.

Newer posts

Older posts