GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.github.com — GitHub Agentic Workflows

GitHub Agentic Workflows

AI-powered workflows for GitHub

Use Copilot, Claude, Codex or Antigravity to automatically triage issues, investigate failures and open pull requests across your repos.

With strong guardrails, permissions, audit and cost controls, in GitHub Actions.

Create a workflowPaste into your favourite coding agentInitialize this repository for GitHub Agentic Workflows using https://raw.githubusercontent.com/github/gh-aw/main/install.md

Prefer a guided form? Try the workflow wizard ↗

You

Create a daily agentic workflow that gives me an issue summary

Added daily-issue-summary.md and opened a pull request.

.github/workflows/daily-issue-summary.md

---
on: daily
safe-outputs:
  create-issue:
---
Summarise yesterday's issues. Flag
anything that needs a reply.

Next morning, 08:00

Issue summary — Oct 2 #241Open

9 new issues, 6 closed
2 waiting on a maintainer reply
#482 blocked on design review

Put coding agents to work on repository tasks, on your schedule or events.

Configure your preferred coding agents to help triage issues, investigate failures and open pull requests in GitHub Actions. Runs follow the schedules or events, permissions and limits you configure. Review generated changes before merging.

Create a workflowPaste into your favourite coding agentInitialize this repository for GitHub Agentic Workflows using https://raw.githubusercontent.com/github/gh-aw/main/install.md

Prefer a guided form? Try the workflow wizard ↗

While you sleptocto-org/app

Good morning — 3 updates awaiting your review.

02:10
02:10CI Doctor opened an issue
Flaky test: db timeout in integration suite #519Likely root cause: shared fixture reused across workers
04:30
04:30Test Improver opened a pull request
Add tests for parser edge cases #231Coverage +3.1%
07:00
07:00Repo Status posted the daily report
Daily status — Oct 2 #23312 issues triaged · 4 PRs merged

Continuous AI for your repository, triggered by your configuration.

Complement CI and CD with coding agents that help triage issues, update documentation, add tests and propose fixes. Workflows run in GitHub Actions on configured schedules or events, within the permissions and limits you set.

Create a workflowPaste into your favourite coding agentInitialize this repository for GitHub Agentic Workflows using https://raw.githubusercontent.com/github/gh-aw/main/install.md

Prefer a guided form? Try the workflow wizard ↗

CIBuilds it7b21e0c04d9a19ef3b

CDShips itv2.3.1v2.4.0

Continuous AIRuns on configured schedules or eventsScheduled or event-triggered

TriageLabelled and asked for repro steps #482now
DocsSynced CLI flags with --help #2141h
TestsCoverage up 3.1% in the parser #2313h
FixesDiagnosed a flaky db timeout #5195h

Workflows ready to run

Ready-made workflows, running in real repositories today. Paste one prompt into your coding agent to add it to your repo.

Repo Assist

Twice a day

A repository assistant that triages issues, fixes bugs and proposes improvements.

Each run it picks tasks to suit the state of your repository: labelling and investigating issues, fixing bugs, adding tests and engineering improvements. It keeps a monthly activity summary so maintainers can see what it did.

Running in 13 open-source repos, Repo Assist has closed 578 issues, with issues closing a median 8X faster.

Paste into your favourite coding agentCreate a workflow for GitHub Agentic Workflows using https://raw.githubusercontent.com/github/gh-aw/main/create.md The purpose of the workflow is to act as a repository assistant: twice a day, triage new issues, fix bugs, and open small pull requests with improvements.Read more →

[Repo Assist] Monthly activity, October #300

Open

github-actions commented · this week

Labelled 14 new issues
Opened #318 Fix trailing comment handling
#309 Speed up config loading was merged
Closed #297 as a duplicate of #284
Opened #322 Add tests for the config loader

CI Doctor

When CI fails

Investigates failing CI and opens an issue with the likely root cause.

It reads the failed job’s logs alongside the commit and pull request that triggered it, then files one issue with the likely root cause and next steps. Repeat failures update that issue instead of adding noise.

Paste into your favourite coding agentCreate a workflow for GitHub Agentic Workflows using https://raw.githubusercontent.com/github/gh-aw/main/create.md The purpose of the workflow is to investigate failing CI runs: read the logs, find the likely root cause, and open an issue with the diagnosis and next steps.Read more →

Some checks were not successful
1 failing and 1 successful check

CI / testFailing after 2m

CI / lintSuccessful in 12s

github-actions opened test job times out on db setup #519

github-actions commented

Likely root cause: DB_HOST is unset since the runner image update in #512. Next step: set the service hostname in ci.yml.

Repo Status

Daily

A daily report of what happened in your repository, posted as an issue.

It gathers pull requests, issues and workflow results, then writes a short status report. Yesterday’s report closes when today’s arrives.

Paste into your favourite coding agentCreate a workflow for GitHub Agentic Workflows using https://raw.githubusercontent.com/github/gh-aw/main/create.md The purpose of the workflow is a daily report on recent activity in the repository, delivered as an issue.Read more →

Daily status, 2 October #507

Open

github-actions opened this issue

A busy day: two long-running PRs landed.

6PRs merged4issues opened9issues closed

#309 made config loading 3X faster
CI is green on main after #521
#301 needs a maintainer decision

Test Improver

Daily

Opens pull requests that improve test coverage where it matters.

It works out how your project builds and measures coverage, finds high-value gaps, and opens pull requests with the measured improvement. It keeps its own pull requests up to date.

Paste into your favourite coding agentCreate a workflow for GitHub Agentic Workflows using https://raw.githubusercontent.com/github/gh-aw/main/create.md The purpose of the workflow is to run daily and improve test coverage: find untested code and open pull requests that add focused tests.Read more →

Add tests for the config loader #322

Open

test/config.test.ts+64−0

test/fixtures/app.yml+12−0

Coverage for src/config.ts41%88%

All checks have passed212 tests

Show 12 more workflowsShow fewer

Maintain

Improve code

Report and plan

Workflow patterns in the docs →

Watch it run

Create and run your first workflow in under two minutes.

Install the extension, add a sample workflow and trigger the first run. Follow the quick start →

Ask Copilot in your repository's Agents tab to write the workflow for you. Create a workflow →

Safe by default

Agents read by default. Every write is checked before it lands.

An agent becomes dangerous when it has private data, untrusted content and outbound access all at once. Security researchers call it the lethal trifecta. gh-aw defends in depth through six security layers that prevent agents from leaking private data.

Private dataSecrets and credentialsIsolated sandboxUntrusted contentIssues and PR commentsIntegrity filteringOutbound accessWeb pages, APIs, writesAgent firewallIsolated sandboxIntegrity filteringAgent firewallthe lethal trifectaAgent

Diagram of the lethal trifecta: three capabilities that are dangerous when an agent holds all of them at once. Private data means secrets and credentials. Untrusted content means issues and pull request comments. Outbound access means web pages, APIs and writes. Each one would reach the agent at the centre, but gh-aw cuts every leg: the isolated sandbox keeps private data away from the agent, integrity filtering screens untrusted content, and the agent firewall restricts outbound access.

Six layers of defence

Step through the layers.

The agent

Compile-time validation
Schema validation, expression allowlisting and pinned actions are checked before a workflow can ever run.
Learn more
Sandboxed agent
The agent runs read-only by default, with optional Cloud Hypervisor microVMs for stronger isolation.
Learn more
Credential isolation
An API proxy holds the tokens, so the agent never sees them and cannot leak them.
Learn more
Integrity filtering
Untrusted GitHub content is filtered before the agent sees it.
Learn more
Threat detection
A separate job scans proposed outputs and blocks suspicious ones.
Learn more
Safe outputs
Only the writes you declared are applied, by a separate job with its own permissions.
Learn more

Your repository

Try it safely: staged: true previews every output without writing anything.

Read the security architecture →

How it works

Prompt your coding agent to create a workflow. GitHub compiles it into an Actions workflow and runs it.

GitHub Copilot
/agentic-workflows
Create a daily status workflow.
/agentic-workflow optimize it
Prompt
Ask your coding agent for a workflow in plain language, then refine it with /agentic-workflow optimize it.
Terminal
$ gh aw compile
triage.lock.yml
Pinned, validated GitHub Actions YAML
Compile
gh aw compile turns it into a hardened, pinned Actions workflow.
Actions
triage · agent48s
Applied labeltype: bug
Run
Your chosen agent runs in GitHub Actions; approved outputs are applied.

Runs the coding agent you choose

Bring your own engine →Import Aider, Crush or your own definition.

Read. Propose. Check. Apply.

The agent reasons about your repository. It does not hold the authority to change it.

01
Trigger
IssuesPull requestsPushesActions
JiraVia authenticated repository dispatch
Also runs on schedules and manual dispatch.
02
Agent
Integrity filtered Inputs
Isolated agent sandbox
0 secrets
Read-only GitHub toolsAllowlisted network
Writes staged as artifacts
03
Safe outputs
SanitizationThreat detection
Declared writes appliedSeparate job with scoped permissions

Self-hosted supported MicroVM optional / preview Agent firewall OIDC credential providers supported

Default security model shown. Custom steps and integrations need separate review. Threat findings follow configured block or review policy.

Explore the security architecture

Cost under control

Set a budget per run and see where every credit goes.

AI credits: 256.9 AIC≈ $2.57
Runs: 61 stopped at cap
Tokens: 2.0M334K per run
Avg turns: 17.3max 44

AI credits per run

0255075

max-ai-credits 100

Run 18409322715, Sep 25: 28.1 AIC, 11 turns, 2.6m28.1#1840932271528.1 AIC · 11 turns · 2.6mSep 25
Run 18409951280, Sep 26: 33.2 AIC, 13 turns, 3.1m33.2#1840995128033.2 AIC · 13 turns · 3.1mSep 26
Run 18410763311, Sep 28: 24.9 AIC, 9 turns, 2.2m24.9#1841076331124.9 AIC · 9 turns · 2.2mSep 28
Run 18411520968, Sep 29: 100.6 AIC, 44 turns, 9.8m, stopped at cap100.6#18411520968100.6 AIC · 44 turns · 9.8mSep 29
Run 18411877042, Oct 1: 38.7 AIC, 15 turns, 3.4m38.7#1841187704238.7 AIC · 15 turns · 3.4mOct 1
Run 18412093317, Oct 1: 31.4 AIC, 12 turns, 2.9m31.4#1841209331731.4 AIC · 12 turns · 2.9mOct 1

Budget guardrails

Cap every run, limit daily spending and find the expensive runs.

Cap every run
max-ai-credits and max-turns stop a run that runs away. On by default: 1,000 AI Credits per run.
Set a budget →
Cap every day
max-daily-ai-credits limits a workflow across 24 hours, 5,000 AIC by default. Over budget, the agent is skipped.
Daily limits →
Find the expensive runs
gh aw logs lists tokens, AIC and turns per run. gh aw audit breaks one down. 1 AIC is $0.01.
Monitor cost →

Send traces to any OTLP backend with OpenTelemetry, and compare cost with outcomes.

Enterprise ready

Your infrastructure. Your trust policies. Agents that fit both.

Bring your own Linux self-hosted runners, or scale on Kubernetes with ARC and Docker-in-Docker.

Choose Docker isolation or preview Cloud Hypervisor and NVX microVMs on compatible hosts. Apply integrity policies to filter GitHub content by author trust and merge status before it reaches the agent.

Explore agent runtimes →

Your GitHub Actions runners

GitHub-hostedSelf-hostedARC DinD

Agent Workflow FirewallControlled egress · Isolated credentials

Choose your isolation

DockerDefaultLinux runners · ARC DinD Cloud HypervisorPreviewGitHub-hosted Ubuntu · KVM NVXPreviewLinux x86_64 · KVM

Integrity filteringYour trust policy, before inference

OpenTelemetryWorkflow, agent and tool-call spansOTLP

Your monitoring stack

Runtime eligibility varies by host. Cloud Hypervisor and NVX are preview runtimes; ARC DinD uses Docker.

Centralized campaigns

Run on your own infrastructure, across every repository.

.github/workflows/triage.md

org/acme16 repositories

api
web
docs
infra
mobile
billing
auth
search
cli
payments
analytics
sdk-js
ios
android
platform
support

Self-hosted runners

arc-linux-01
arc-linux-02
arc-linux-03

Your own runners
Run on Linux self-hosted runners, including Actions Runner Controller with Docker-in-Docker.
Self-hosted runners →
Every repository
Roll workflows out across an organization or enterprise and manage them centrally.
Using at scale →

Keep going

Create your first workflow

Create a workflowPaste into your favourite coding agentInitialize this repository for GitHub Agentic Workflows using https://raw.githubusercontent.com/github/gh-aw/main/install.md

Prefer a guided form? Try the workflow wizard ↗

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

GitHub Agentic Workflows

AI-powered workflows for GitHub

Put coding agents to work on repository tasks, on your schedule or events.

Continuous AI for your repository, triggered by your configuration.

Workflows ready to run

Repo Assist

CI Doctor

Repo Status

Test Improver

Maintain

Improve code

Report and plan

Watch it run

Safe by default

Six layers of defence

Compile-time validation

Sandboxed agent

Credential isolation

Integrity filtering

Threat detection

Safe outputs

How it works

Prompt

Compile

Run

Read. Propose. Check. Apply.

Trigger

Agent

Safe outputs

Cost under control

AI credits per run

Budget guardrails

Cap every run

Cap every day

Find the expensive runs

Enterprise ready

Centralized campaigns

Your own runners

Every repository

Keep going

Create your first workflow