Safer Agent Automation with GitHub Agentic Workflows

**Bret Fisher** (0:00)
Say something's gone wrong in your repository, you don't wanna have to get up in the morning, and say, oh my God, something's gone wrong. Should I have coffee or should I investigate it? You shouldn't have to make that trade-off because the agent should have already investigated it for you. So you should be able to just go to your breakfast, have your coffee, read the report, read the analysis, and it says, here's a possible fix for it. Here's actually meta pool request for it. And you go, oh yeah man, uh, we, we gotta fix that. Let's get that in. it should be there, ready for you. the agent should be proactive and should be immersed in a world of cooperative agents. Bret (2): Welcome to the Agentic DevOps podcast, and I am your host, Bret Fisher, back with another episode about one of my most exciting things that I'm working on this year, the project that I am adopting on GitHub, and I am trying to dig into the weeds as much as possible because I think that GitHub is onto something. Specifically GitHub Next and Microsoft Research, which are both the research arms of both those organizations, and they're working together to evolve GitHub Actions to what it would be if it was AI native. What would it be if AI was there in a safe and reproducible way that we could sandbox and protect in a, in a very detailed and heavily scrutinized way? And it's not what you think. It is not simply just adding LLM prompts into GitHub Actions, which you could do today, and you've been able to do for years. It's not simply just adding Claude Code as a step in your GitHub Action. Those are things that already existed. But out of GitHub Next last year, we heard about the early alpha beta release of something called Agentic Workflows, which is technically what I would call a feature of GitHub Actions, but it's a whole website now with tons of examples, a team working on it. And when you really dig into the details of what this is, I think this is the only way we should be doing anything with an AI inside of GitHub Actions. If we are prompting in GitHub Actions, they should be using this tool, in my opinion. As I dig more into this, and then the recent Claude Code security concern that we had, and then all of the security concerns we've had around GitHub Actions lately related specifically not to the supply chain per se, but specifically to workflows that are getting basically prompt injected through untrusted prompt input. That is one of the biggest risks anywhere we put a model, whether it's in a chatbot or it's in our automation or it's in front of some of our systems.
If someone can put untrusted text in a place that somehow doesn't get verified by a trusted member of our team before it goes to a model, that's a risky place to be, and that's part of our job. Platform engineers, DevOps, security engineers, like we're all very concerned about that, right? We're maybe a little bit trepidatious on what we should be doing with these things today, which is automating more of our systems because we don't wanna be that person on the team that gets caught putting risky AI stuff into automation. 'Cause as we know, automation can make good things really easy. It can reduce toil, but it can also automate the bad things if we're not careful, and you can sometimes automate yourself all the way into an outage. So we have on the show this time Don from GitHub Next. That's their research arm full of PhDs and experts that are trying to figure out tooling for the future of GitHub. Personally, I just love GitHub Next. I'm always on their website, githubnext.com, and looking at what they're working on because to me it's like reading the tea leaves of where the big money is researching for the future of software development life cycle. And we also have Pele from Microsoft Research, who's also on the team building this product And using it daily, which we get into exactly how they use it. And I'm really excited because I feel like this system has a lot of rigor to it, which is what I'm looking for. And when I'm thinking about implementing AI anywhere in my automation, especially when it comes to CI/CD automation, possibly anything around my code repos, I'm wanting that to be as secure as possible. So I look to make my steps deterministic with traditional programming, and then only as a last resort when I need a judgment or a, maybe a consolidation of text or a summary of text, that's when I consider putting in models. And I used to just attach Claude Code, maybe build it a workflow around that, or attach Codex or Copilot as a step, but this is something totally different. You use command line tools to generate something that is a very long workflow. You use CLI tools to create a lock file to make sure that that doesn't change. You establish rigor around making sure that the prompts and the things that you're trying to create with AI are trustworthy and can be sandboxed and protected properly. And I feel like the depths that I've gone into after this show that we're gonna get into in a second, I feel like I now can say this is how I'm only gonna be doing the AI in GitHub Actions. So welcome to the show Don and Pele, and let's get into it. Don tell us who you are and how you got here.