GitHub Agentic Workflows

Blog

Weekly Update – March 18, 2026

It’s been a busy week in github/gh-aw — seven releases shipped between March 13 and March 17, covering everything from a security model overhaul to a new label-based trigger and a long-overdue terminal resize fix. Let’s dig in.

The freshest release focuses on reliability and developer experience:

  • Automatic debug logging (#21406): Set ACTIONS_RUNNER_DEBUG=true on your runner and full debug logging activates automatically — no more manually adding DEBUG=* to every troubleshooting run.
  • Cross-repo project item updates (#21404): update_project now accepts a target_repo parameter, so org-level project boards can update fields on items from any repository.
  • GHE Cloud data residency support (#21408): Compiled workflows now auto-inject a GH_HOST step, fixing gh CLI failures on *.ghe.com instances.
  • CI build artifacts (#21440): The build CI job now uploads the compiled gh-aw binary as a downloadable artifact — handy for testing PRs without a local build.

This release rewires the security model. Breaking change: automatic lockdown=true is gone. Instead, the runtime now auto-configures guard policies on the GitHub MCP server — min_integrity=approved for public repos, min_integrity=none for private/internal. Remove any explicit lockdown: false from your frontmatter; it’s no longer needed.

Other highlights:

  • GHES domain auto-allowlisting (#21301): When engine.api-target points to a GHES instance, the compiler automatically adds GHES API hostnames to the firewall. No more silent blocks after every recompile.
  • github-app: auth in APM dependencies (#21286): APM dependencies: can now use github-app: auth for cross-org private package access.

A feature-packed release with two breaking changes (field renames in safe-outputs.allowed-domains) and several new capabilities:

  • Label Command Trigger (#21118): Activate a workflow by adding a label to an issue, PR, or discussion. The label is automatically removed so it can be reapplied to re-trigger.
  • gh aw domains command (#21086): Inspect the effective network domain configuration for all your workflows, with per-domain ecosystem annotations.
  • Pre-activation step injection — New on.steps and on.permissions frontmatter fields let you inject custom steps and permissions into the activation job for advanced scenarios.
  • v0.58.3 (March 15): MCP write-sink guard policy for non-GitHub MCP servers, Copilot pre-flight diagnostic for GHES, and a richer run details step summary.
  • v0.58.2 (March 14): GHES auto-detection in audit and add-wizard, excluded-files support for create-pull-request, and clearer run command errors.
  • v0.58.1 / v0.58.0 (March 13): call-workflow safe output for chaining workflows, checkout: false for agent jobs, custom OpenAI/Anthropic API endpoints, and 92 merged PRs in v0.58.0 alone.
  • Top-level github-app fallback (#21510): Define your GitHub App config once at the top level and let it propagate to safe-outputs, checkout, MCP, APM, and activation — instead of repeating it in every section.
  • GitHub App-only permission scopes (#21511): 31 new PermissionScope constants cover repository, org, and user-level GitHub App permissions (e.g., administration, members, environments).
  • Custom Huh theme (#21557): All 11 interactive CLI forms now use a Dracula-inspired theme consistent with the rest of the CLI’s visual identity.
  • Weekly blog post writer workflow (#21575): Yes, the workflow that wrote this post was itself merged this week. Meta!
  • CI job timeout limits (#21601): All 25 CI jobs that relied on GitHub’s 6-hour default now have explicit timeouts, preventing a stuck test from silently burning runner compute.

The first-ever Agent of the Week goes to the workflow that handles the unglamorous but essential job of keeping the issue tracker from becoming a swamp.

auto-triage-issues runs on a schedule and fires on every new issue, reading each one and deciding how to categorize it. This week it ran five times — three successful runs and two that were triggered by push events to a feature branch (which apparently fire the workflow but don’t give it much to work with). On its scheduled run this morning, it found zero open issues in the repository, so it created a tidy summary discussion to announce the clean state, as instructed. On an earlier issues-triggered run, it attempted to triage issue #21572 but hit empty results from GitHub MCP tools on all three read attempts — so it gracefully called missing_data and moved on rather than hallucinating a label.

Across its recent runs it made 131 search_repositories calls. We’re not sure why it finds repository searches so compelling, but clearly it’s very thorough about knowing its neighborhood before making any decisions.

Usage tip: Pair auto-triage-issues with a notify workflow on specific labels (e.g., security or needs-repro) so the right people get pinged automatically without anyone having to watch the inbox.

View the workflow on GitHub

Update to v0.61.0 to get all the improvements from this packed week. If you run workflows on GHES or in GHE Cloud, the new auto-detection and GH_HOST injection features are especially worth trying. As always, contributions and feedback are welcome in github/gh-aw.

Meet the Workflows: Project Coordination

Peli de Halleux

My dear friends, we’ve arrived at the grand finale - the most spectacular room of all in Peli’s Agent Factory!

We’ve journeyed through 18 categories of workflows - from triage bots to code quality improvers, from security guards to creative poets, culminating in advanced analytics that use machine learning to understand agent behavior patterns. Each workflow handles its individual task admirably.

But here’s the ultimate challenge: how do you coordinate multiple agents working toward a shared goal? How do you break down a large initiative like “migrate all workflows to a new engine” into trackable sub-tasks that different agents can tackle? How do you monitor progress, alert on delays, and ensure the whole is greater than the sum of its parts? This final post explores planning, task-decomposition and project coordination workflows - the orchestration layer that proves AI agents can handle not just individual tasks, but entire structured projects requiring careful coordination and progress tracking.

These agents coordinate multi-agent plans and projects:

  • Plan Command - Breaks down issues into actionable sub-tasks via /plan command - 514 merged PRs out of 761 proposed (67% merge rate)
  • Discussion Task Miner - Extracts actionable tasks from discussion threads - 60 merged PRs out of 105 proposed (57% merge rate)

Plan Command has contributed 514 merged PRs out of 761 proposed (67% merge rate), providing on-demand task decomposition that breaks complex issues into actionable sub-tasks. This is the highest-volume workflow by attribution in the entire factory. Developers can comment /plan on any issue to get an AI-generated breakdown into actionable sub-issues that agents can work on. A verified example causal chain: Discussion #7631Issue #8058PR #8110.

Discussion Task Miner has contributed 60 merged PRs out of 105 proposed (57% merge rate), continuously scanning discussions to extract actionable tasks that might otherwise be lost. The workflow demonstrates perfect causal chain attribution: when it creates an issue from a discussion, and Copilot Coding Assistant later fixes that issue, the resulting PR is correctly attributed to Discussion Task Miner. A verified example: Discussion #13934Issue #14084PR #14129. Recent merged examples include fixing firewall SSL-bump field extraction and adding security rationale to permissions documentation.

We learned that individual agents are great at focused tasks, but orchestrating multiple agents toward a shared goal requires careful architecture. Project coordination isn’t just about breaking down work - it’s about discovering work (Task Miner), planning work (Plan Command), and tracking work (Workflow Health Manager).

These workflows implement patterns like epic issues, progress tracking, and deadline management. They prove that AI agents can handle not just individual tasks, but entire projects when given proper coordination infrastructure.

You can add these workflows to your own repository and remix them. Get going with our Quick Start, then run one of the following:

Plan Command:

Terminal window
gh aw add-wizard https://github.com/github/gh-aw/blob/v0.45.5/.github/workflows/plan.md

Discussion Task Miner:

Terminal window
gh aw add-wizard https://github.com/github/gh-aw/blob/v0.45.5/.github/workflows/discussion-task-miner.md

Then edit and remix the workflow specifications to meet your needs, regenerate the lock file using gh aw compile, and push to your repository. See our Quick Start for further installation and setup instructions.

You can also create your own workflows.


Throughout this 19-part journey, we’ve explored workflows spanning from simple triage bots to sophisticated multi-phase improvers, from security guards to creative poets, from individual task automation to organization-wide orchestration.

The key insight? AI agents are most powerful when they’re specialized, well-coordinated, and designed for their specific context. No single agent does everything - instead, we have an ecosystem where each agent excels at its particular job, and they work together through careful orchestration.

We’ve learned that observability is essential, that incremental progress beats heroic efforts, that security needs careful boundaries, and that even “fun” workflows can drive meaningful engagement. We’ve discovered that AI agents can maintain documentation, manage campaigns, analyze their own behavior, and continuously improve codebases - when given the right architecture and guardrails.

As you build your own agentic workflows, remember: start small, measure everything, iterate based on real usage, and don’t be afraid to experiment. The workflows we’ve shown you evolved through experimentation and real-world use. Yours will too.

This is part 19 (final) of a 19-part series exploring the workflows in Peli’s Agent Factory.

Meet the Workflows: Advanced Analytics & ML

Peli de Halleux

Ooh! Time to plunge into the data wonderland at Peli’s Agent Factory! Where numbers dance and patterns sing!

In our previous post, we explored organization and cross-repo workflows that operate at enterprise scale - analyzing dozens of repositories together to find patterns and outliers that single-repo analysis would miss. We learned that perspective matters: what looks normal in isolation might signal drift at scale.

Beyond tracking basic metrics (run time, cost, success rate), we wanted deeper insights into how our agents actually behave and how developers interact with them. What patterns emerge from thousands of agent prompts? What makes some PR conversations more effective than others? How do usage patterns reveal improvement opportunities? This is where we brought out the big guns: machine learning, natural language processing, sentiment analysis, and clustering algorithms. Advanced analytics workflows don’t just count things - they understand them, finding patterns and insights that direct observation would never reveal.

These agents use sophisticated analysis techniques to extract insights:

Prompt Clustering Analysis has created 27 analysis discussions using ML to categorize thousands of agent prompts - for example, #6918 clustering agent prompts to identify patterns and optimization opportunities. It revealed patterns we never noticed (“oh, 40% of our prompts are about error handling”).

Copilot PR NLP Analysis applies natural language processing to PR conversations, performing sentiment analysis and identifying linguistic patterns across agent interactions. It found that PRs with questions in the title get faster review.

Copilot Session Insights has created 32 analysis discussions examining Copilot coding agent usage patterns and metrics across the workflow ecosystem. It identifies common patterns and failure modes.

Copilot Coding Agent Analysis has created 48 daily analysis discussions providing deep analysis of agent behavior patterns - for example, #6913 with the daily Copilot coding agent analysis.

What we learned: meta-analysis is powerful - using AI to analyze AI systems reveals insights that direct observation misses. These workflows helped us understand not just what our agents do, but how they behave and how users interact with them.

You can add these workflows to your own repository and remix it as follows:

Copilot Session Insights:

Terminal window
gh aw add-wizard https://github.com/github/gh-aw/blob/v0.45.5/.github/workflows/copilot-agent-analysis.md

Copilot PR NLP Analysis:

Terminal window
gh aw add-wizard https://github.com/github/gh-aw/blob/v0.45.5/.github/workflows/copilot-pr-nlp-analysis

Prompt Clustering Analysis:

Terminal window
gh aw add-wizard https://github.com/github/gh-aw/blob/v0.45.5/.github/workflows/prompt-clustering-analysis.md

Copilot Agent Analysis:

Terminal window
gh aw add-wizard https://github.com/github/gh-aw/blob/v0.45.5/.github/workflows/copilot-agent-analysis.md

Then edit and remix the workflow specifications to meet your needs, regenerate the lock file using gh aw compile, and push to your repository. See our Quick Start for further installation and setup instructions.

You can also create your own workflows.

We’ve reached the final stop: coordinating multiple agents toward shared, complex goals across extended timelines.

Continue reading: Project Coordination Workflows →


This is part 18 of a 19-part series exploring the workflows in Peli’s Agent Factory.

Meet the Workflows: Organization & Cross-Repo

Peli de Halleux

Let’s zoom out at Peli’s Agent Factory!

In our previous post, we explored multi-phase improver workflows - our most ambitious agents that tackle big projects over multiple days, maintaining state and making incremental progress. These workflows proved that AI agents can handle complex, long-running initiatives when given the right architecture.

But all that sophisticated functionality has focused on a single repository. What happens when you zoom out to organization scale? What insights emerge when you analyze dozens or hundreds of repositories together? What looks perfectly normal in one repo might be a red flag across an organization. Organization and cross-repo workflows operate at enterprise scale, requiring careful permission management, thoughtful rate limiting, and different analytical lenses. Let’s explore workflows that see the forest, not just the trees.

These agents work at organization scale, across multiple repositories:

  • Org Health Report - Organization-wide repository health metrics - 4 organization health discussions created
  • Stale Repo Identifier - Identifies inactive repositories - 2 issues flagging truly stale repos
  • Ubuntu Image Analyzer - Documents GitHub Actions runner environments - 4 merged PRs out of 8 proposed (50% merge rate)

Scaling agents across an entire organization changes the game. Org Health Report has created 4 organization health discussions analyzing dozens of repositories at scale - for example, #6777 with the December 2025 organization health report. It identifies patterns and outliers (“these three repos have no tests, these five haven’t been updated in months”).

Stale Repo Identifier has created 2 issues flagging truly stale repositories for organizational hygiene - for example, #5384 identifying Skills-Based-Volunteering-Public as truly stale. It helps find abandoned projects that should be archived or transferred.

We learned that cross-repo insights are different - what looks fine in one repository might be an outlier across the organization. These workflows require careful permission management (reading across repos needs organization-level tokens) and thoughtful rate limiting (you can hit API limits fast when analyzing 50+ repos).

Ubuntu Image Analyzer has contributed 4 merged PRs out of 8 proposed (50% merge rate), documenting GitHub Actions runner environments to keep the team informed about available tools and versions. It’s wonderfully meta - it documents the very environment that runs our agents.

You can add these workflows to your own repository and remix them. Get going with our Quick Start, then run one of the following:

Org Health Report:

Terminal window
gh aw add-wizard https://github.com/github/gh-aw/blob/v0.45.5/.github/workflows/org-health-report.md

Stale Repo Identifier:

Terminal window
gh aw add-wizard https://github.com/github/gh-aw/blob/v0.45.5/.github/workflows/stale-repo-identifier.md

Ubuntu Image Analyzer:

Terminal window
gh aw add-wizard https://github.com/github/gh-aw/blob/v0.45.5/.github/workflows/ubuntu-image-analyzer.md

Then edit and remix the workflow specifications to meet your needs, regenerate the lock file using gh aw compile, and push to your repository. See our Quick Start for further installation and setup instructions.

You can also create your own workflows.

Next Up: Advanced Analytics & ML Workflows

Section titled “Next Up: Advanced Analytics & ML Workflows”

Cross-repo insights reveal patterns, but we wanted to go even deeper - using machine learning to understand agent behavior.

Continue reading: Advanced Analytics & ML Workflows →


This is part 17 of a 19-part series exploring the workflows in Peli’s Agent Factory.

Meet the Workflows: Multi-Phase Improvers

Peli de Halleux

Let’s continue our journey through Peli’s Agent Factory!

In our previous post, we explored infrastructure workflows - the meta-monitoring layer that validates MCP servers, checks tool configurations, and ensures the platform itself stays healthy. These workflows watch the watchers, providing visibility into the invisible plumbing.

Most workflows we’ve seen so far run once and complete: analyze this PR, triage that issue, test this deployment. They’re ephemeral - they execute, produce results, and disappear. But what about projects that are too big to tackle in a single run? What about initiatives that require research, setup, and incremental implementation? Traditional CI/CD is built for stateless execution, but we discovered something powerful: workflows that maintain state across days, working a little bit each day like a persistent team member who never takes breaks. Welcome to our most ambitious experiment - multi-phase improvers that prove AI agents can handle complex, long-running projects.

These are some of our most ambitious agents - they tackle big projects over multiple days:

This is where we got experimental with agent persistence and multi-day workflows. Traditional CI runs are ephemeral, but these workflows maintain state across days using repo-memory. The Daily Perf Improver runs in three phases - research (find bottlenecks), setup (create profiling infrastructure), implement (optimize). It’s like having a performance engineer who works a little bit each day. The Daily Backlog Burner systematically tackles our issue backlog - one issue per day, methodically working through technical debt. We learned that incremental progress beats heroic sprints - these agents never get tired, never get distracted, and never need coffee breaks. The PR Fix workflow is our emergency responder - when CI fails, invoke /pr-fix and it investigates and attempts repairs.

These workflows prove that AI agents can handle complex, long-running projects when given the right architecture.

You can add these workflows to your own repository and remix them. Get going with our Quick Start, then run one of the following:

Daily Backlog Burner:

Terminal window
gh aw add-wizard githubnext/agentics/workflows/daily-backlog-burner.md

Daily Perf Improver:

Terminal window
gh aw add-wizard githubnext/agentics/workflows/daily-perf-improver.md

Daily QA:

Terminal window
gh aw add-wizard githubnext/agentics/workflows/daily-qa.md

Daily Accessibility Review:

Terminal window
gh aw add-wizard githubnext/agentics/workflows/daily-accessibility-review.md

PR Fix:

Terminal window
gh aw add-wizard githubnext/agentics/workflows/pr-fix.md

Then edit and remix the workflow specifications to meet your needs, regenerate the lock file using gh aw compile, and push to your repository. See our Quick Start for further installation and setup instructions.

You can also create your own workflows.

Next Up: Organization & Cross-Repo Workflows

Section titled “Next Up: Organization & Cross-Repo Workflows”

Single-repository workflows are powerful, but what happens when you scale to an entire organization with dozens of repositories?

Continue reading: Organization & Cross-Repo Workflows →


This is part 16 of a 19-part series exploring the workflows in Peli’s Agent Factory.