GitHub brings agentic workflows to GitHub Actions

June 12, 2026 — GitHub released GitHub Agentic Workflows in public preview on June 11, 2026, adding coding agents inside GitHub Actions after a four-month technical preview announced in February.

Core Capability

Teams define automations in natural language Markdown files; GitHub compiles them into standard GitHub Actions YAML. Workflows run as Actions and reuse existing runner groups and policy constraints.

Use cases: issue triage, CI failure analysis, documentation updates, vulnerability remediation, dependency maintenance, routine change reviews.

GITHUB_TOKEN Support

Agentic Workflows can now use GitHub Actions’ built-in GITHUB_TOKEN, eliminating the need to create and manage personal access tokens for the feature.

Security Controls

  • Integrity filter rules for GitHub content access
  • Read-only permissions by default
  • Sandboxed container execution behind Agent Workflow Firewall
  • Safe outputs validation process
  • Dedicated threat detection job scans proposed changes before application

Early Adopters

  • Carvana: Engineering work spanning multiple repositories
  • Marks & Spencer: Reusable workflows across security, quality, and delivery; hours of effort reduced to minutes

Supply Chain Context

Article notes unrelated Miasma worm campaign (73 Microsoft repos disabled) involving stolen GitHub Actions secrets — highlights CI/CD security relevance though not connected to Agentic Workflows launch.

  • New hosted runner images in public preview (Ubuntu 26.04 x64/arm64, Windows 11 arm64)
  • Bot-created PRs from github-actions[bot] can run workflows after write-access user approval