GitHub Agentic Workflows Reaches General Availability With Read-Only Defaults

GitHub has made Agentic Workflows generally available, letting coding agents run inside GitHub Actions with read-only permissions by default and separately scoped write jobs. The isolation protections do not extend to direct write permissions or custom jobs, so their real safety depends on how each workflow is configured.

Why it matters: Teams adopting autonomous coding agents in CI need to audit their workflow permissions, because the built-in guardrails only hold if custom jobs and direct write access are configured carefully.