Another GitHub Universe, and this one's all about AI and GitHub Copilot. I'm starting with the Actions changes and will add things I learn and launches I like as the event goes on.
Four changes to Actions
One budget for more compute
Your monthly included compute can now cover larger runners on Team and Enterprise Cloud, not just standard runners. Enterprise Cloud’s allowance is $300 per month; other plans get different amounts. This changes what the allowance covers, not how much you get. Cloud Sandbox billing starts in November and draws from the same pool. AI credits stay separate. (Announcement, allowances by plan)
Pin workflow dependencies
Workflow dependency lockfiles are generally available. Use gh actions-lock to generate .github/workflows/actions.lock, pinning direct and transitive dependencies while keeping readable references in YAML. You can adopt locking one workflow at a time, keep entries updated with Dependabot, and require lockfiles through an admin policy. Locking a dependency doesn't make it safe; review what you're locking. (Announcement)
Add AWS-backed runner capacity
GitHub is rolling out AWS capacity for eligible 2- and 4-core Linux jobs without changing runner labels. Free, Pro, and Team use it automatically; Enterprise Cloud admins opt in. It is not AWS region selection or private-network access. If your workflows use network allowlists, include all published Actions IP ranges, not just Azure's. (Announcement)
Take Agentic Workflows to GA
Agentic Workflows are now generally available. This builds on the public preview with ARC and Docker-in-Docker support, improved credit forecasting, model options and routing, templates, and isolation choices. Workflows remain Markdown compiled into Actions YAML, using existing runner groups and policies. (Announcement, documentation)
Related, but separate
Cloud Sandboxes give Copilot sessions remote, resumable compute. The connected cloud experience is generally available on paid Copilot plans and is rolling out starting October 28. Start on your phone, continue on the web, and pick up the same session in the app, CLI, or VS Code. This does not make Sandboxes an Actions workflow backend. (Announcement)
Copilot Automations are another separate product, configured with prompts, tools, and triggers rather than compiled into Actions YAML. They support shared automations, automation groups, MCP tools, AI credit limits, VS Code management, and API triggers. They can also use outcomes to propose improvements to their own configuration, with your review before changes apply. Repository automations are currently limited to private and internal repositories. (Documentation, self-improvement announcement)
One related Actions feature is already live: Workflow Execution Protections controls who or what can trigger a workflow. Lockfiles control which dependency commits run.