1:03:23
GitHub Agentic Workflows: Automation That Actually Reads the Room
Microsoft Reactor
Overview
This video introduces agentic workflows on GitHub, a new evolution of automation that leverages AI agents like Copilot to interpret natural language instructions and perform complex tasks. Unlike traditional deterministic automation, agentic workflows offer flexibility and can automate tasks such as updating websites with the latest information from blogs and changelogs, generating pull requests, and even creating CI/CD pipelines. The presentation emphasizes the security measures in place, including sandboxing and a five-layer security approach, to prevent agents from causing unintended damage. A practical demonstration walks through setting up and using agentic workflows within a GitHub repository, highlighting how natural language prompts can generate workflow files and automate development processes, ultimately reducing toil for developers.
How was this?
Save this permanently with flashcards, quizzes, and AI chat
Chapters
- Traditional automation (like GitHub Actions) is deterministic and rigid, requiring specific syntax and being error-prone.
- Agentic workflows represent the next evolution, using AI agents (e.g., Copilot, Claude) to understand natural language and execute tasks.
- These workflows abstract away complex syntax like YAML, allowing users to describe desired outcomes in natural language (markdown).
- The process involves defining workflows in markdown, which are then compiled and executed by an agent, enabling AI-powered decision-making.
Agentic workflows offer a more flexible and intuitive way to automate tasks, reducing the need for deep technical knowledge of scripting languages and making automation accessible to a wider range of users.
Describing a workflow in natural language to generate a report for a repository, which the agent then executes.
- A primary concern is preventing AI agents from making unauthorized changes or causing damage to codebases.
- Agentic workflows employ a 'gated job' approach where agents can observe but not directly modify repositories.
- A sandbox environment is used, which is sealed off and has controlled input/output.
- Key security layers include: no secrets in the agent, network firewalls, read-only tokens, and threat detection to prevent malicious code execution.
Robust security measures are crucial for building trust and enabling the adoption of AI-powered automation in production environments, ensuring code integrity and preventing accidental data loss.
The agent can observe your repository but cannot directly change it, operating within a secure, isolated environment.
- The process involves creating a new public GitHub repository and copying a GitHub skill (a pre-built workflow template).
- A personal fine-grained access token with read-only Copilot request access is required.
- This token needs to be added as a repository secret (e.g., 'Copilot GitHub token').
- GitHub Actions permissions must be configured to allow read and write access, including the ability to create and approve pull requests.
Proper setup and configuration, including security tokens and permissions, are essential prerequisites for the agentic workflows to function correctly and securely within your repository.
Creating a new repository named 'reactor' and configuring its settings to allow GitHub Actions to create pull requests.
- Agentic workflows can be initiated using the Copilot CLI or within VS Code.
- Natural language prompts are used to define the workflow's purpose, schedule, tools, and desired output (e.g., creating a pull request).
- The agent generates a markdown file containing the workflow definition, including 'front matter' that guides its execution.
- A 'compile' command transforms the human-readable markdown into machine-readable lock files and action scripts that the agent can execute.
This step demonstrates the core power of agentic workflows: translating high-level natural language goals into executable automation scripts, significantly simplifying complex task definition.
Prompting the agent to create a workflow that fetches the latest GitHub blog posts and changelogs, updates a markdown file, and generates a pull request.
- Once compiled, the workflow can be triggered manually, on demand, or on a schedule.
- The agent executes the defined tasks, such as fetching data from specified web sources.
- The workflow concludes by creating a pull request with the generated changes for human review.
- The process follows a loop: authoring the workflow, executing it, and then reviewing the output (pull request) before merging.
The execution and review phase ensures that the AI-generated changes are accurate and align with project goals, maintaining human oversight in the automation loop.
Running the 'Mona updater' workflow, which fetches new content and creates a draft pull request to update the website's markdown file.
- Workflows can be easily updated by modifying the natural language prompt or the markdown definition.
- Adding new data sources or changing the workflow's behavior can be done by iterating on the prompt.
- The agentic workflow system supports various tools and can be extended with custom instructions and hooks.
- Continuous iteration and verification are key, as AI is a tool to augment, not replace, human judgment.
The ability to easily iterate and enhance workflows allows developers to continuously improve their automation processes and adapt them to evolving needs.
Adding a new source, 'Awesome Copilot,' to the workflow's front matter and recompiling to include it in future updates.
Key takeaways
- Agentic workflows leverage AI to translate natural language into executable automation, abstracting away complex scripting.
- Security is paramount, with agentic workflows employing sandboxing and multiple layers of protection to safeguard repositories.
- Setting up agentic workflows involves repository configuration, secure token management, and appropriate GitHub Actions permissions.
- The core process involves defining workflows in markdown, compiling them into executable scripts, and executing them to automate tasks.
- Human review remains critical; agentic workflows generate pull requests for review, ensuring AI-generated changes are verified before merging.
- Iteration is key: workflows can be easily modified and enhanced by updating natural language prompts or markdown definitions.
- Agentic workflows significantly reduce developer toil by automating repetitive tasks like content updates and CI/CD pipeline creation.
Key terms
Agentic WorkflowsGitHub ActionsDeterministic AutomationAI AgentsCopilotNatural Language PromptingMarkdownSandbox EnvironmentFine-grained TokenPull RequestCompileLock FileFront Matter
Test your understanding
- How do agentic workflows differ from traditional deterministic automation in terms of flexibility and user input?
- What are the primary security mechanisms employed by agentic workflows to protect code repositories?
- Describe the essential steps required to set up agentic workflows within a GitHub repository.
- Explain the role of natural language prompts and the 'compile' step in creating and executing an agentic workflow.
- Why is human review still a necessary part of the agentic workflow process, even with advanced AI capabilities?