5-Part Series

AI-Native CI/CD

A visual journey through the new era of automation, platforms, agents, and developer compute.

Part 1

Automation is The Obvious Choice

The ROI bar just hit the floor.

Read the full post →

The Trap:
Doing the same work faster.

Crushing Jira tickets with Copilot feels amazing. But writing code faster doesn't mean you ship 10x faster.

"The bottleneck was almost never your programming abilities or typing speed."

10x Speed
1x Shipping

Where is your time actually going?

Writing code is maybe 20% of your day. The rest is...

20% Writing Code
Code Reviews Debugging CI Updating Docs Flaky Tests Infra Context-Switching

The Old Math

Automation was valuable, but the ROI bar was high. It needed large scale and a long lifetime to justify the cost.

1

Too expensive to build

2

Manual processes calcify

3

"That's just how we do it"

Just Automate It

The ROI bar has collapsed. AI can generate the workflow, write the action, and compose the pipeline.

"If a task can be automated, then choosing to automate it is almost always the better choice."

The Compounding Factor

This is where it gets exponential, not linear.

AI Builds

Uses AI to build traditional tools: tests, linters, pipelines.

Automation Runs

Runs thousands of times across dozens of repos automatically.

Propels Faster

Keeps saving manual effort even when the AI is idle.

The AI builds the automation, the automation keeps compounding.

The Mental Shift

The question is no longer "is this worth automating?"

1. Prioritize

What should I automate first?

Look for highest frequency × highest toil tasks.

2. Secure

How do I make it trustworthy?

Implement proper testing, guardrails, and monitoring.

3. Scale

How do I scale across the org?

Build reusable workflows, templates, and innersource.

Stop using AI just to write features faster.
Start using AI to build the automation infrastructure that makes your entire team faster.

Part 2

The AI-Native Platform

Actions is the execution layer — and it's purpose-built for the agentic era.

Read the full post →

What's Already Running on Actions

Things you use every day that are Actions under the hood.

🤖 Copilot Code Review

Runs as a PR check via Actions. LLM + CodeQL analyze your PR.

🧑‍💻 Copilot Coding Agent

Plans, codes, tests, opens PRs — all on GH-hosted runners.

🔄 Dependabot

Version updates, security alerts, auto-PRs — all via Actions.

🔒 GHAS / CodeQL

Code scanning, secret scanning, security analysis — Actions workflows.

💻 Codespace Prebuilds

Dev environment prebuilds run on Actions for instant startup.

🌐 GitHub Pages

Site builds and deployments run as Actions workflows.

One Execution Layer to Rule Them All

The same event triggers, runner infrastructure, and security model that powers GitHub's own features — all available to you.

"If you know how to write a workflow, you know how to orchestrate an AI agent."

🎯

One execution model

Workflows for CI/CD AND AI agents

🔐

One security model

Permissions, secrets, OIDC — same everywhere

📊

One observability story

Logs, summaries, data streams — for CI and agents

🌊

Network effects

Every Actions improvement benefits CI AND AI automations

AI Makes CI/CD More Critical

AI agents are non-deterministic. They generate different code each time. You need strong deterministic automation wrapped around them to catch what agents get wrong.

The better your CI/CD pipeline, the more autonomy you can give your agents.

Why Actions Is Purpose-Built for AI

🧠 LLMs Understand It Best

Largest CI usage base = most training data. AI writes better Actions YAML than any other CI system.

🧱 Building Block Architecture

Composable actions = black boxes with clear interfaces. Perfect for AI reasoning about inputs/outputs.

♻️ Reusability = Token Efficiency

Call a pre-built action instead of inline script → save tokens AND reduce error surface. 20K+ marketplace blocks.

🔐 Secure by Default

Per-repo permission model. Agents can experiment freely within safe boundaries. No global admin key.

Why GitHub-Hosted Runners

AI agents run code they generate themselves. They install packages. They make API calls. They iterate.

On ephemeral GHRs, every agent run starts clean and ends clean. No persistence, no lateral movement.

🛡️Ephemeral VMs — fresh every job
🏗️Zero maintenance — no patching, no K8s
Instant burst — hundreds of concurrent runners
🌐VNET injection — reach private resources
📉30% price drop — January 2026
📊Actions Data Stream — real-time telemetry
Part 3

Agentic Workflows on GitHub Events

Run AI agents triggered on any GitHub event. Safe, secure, and ephemeral.

Read the full post →

5 Ways to Use AI in Actions

From simple inference to full agent frameworks.

🔮

Copilot Models

Single LLM call. Classify, summarize, label.

Trivial
🤖

Coding Agent

Assign issue → agent opens PR. Zero config.

Zero-config
📋

gh aw

Markdown-defined with built-in guardrails. The paved path.

Recommended

Copilot CLI

Full autopilot with MCP tools. Any CI task.

Medium
🧬

Copilot SDK

Raw model APIs. Build your own agent framework.

Full Control

The Fully Automated Chain

📡

GitHub Event

Issue labeled, PR opened, schedule fires

🤖

AI Agent

Plans, codes, tests on ephemeral runner

🔀

Pull Request

Code reviewed, tests pass, ready to merge

👤

Human Review

No human in the loop until merge time

Event → Agent → PR → Review. Fully automated until the last mile.

What You Can Build

🏷️ Issue & PR Management

Auto-triage, label, assign, coordinate across projects.

📚 Continuous Documentation

Keep docs consistent, up-to-date, and auto-maintained.

⚙️ Continuous Improvement

Daily code simplification, refactoring, tech debt cleanup.

📊 Metrics & Analytics

Daily reports, trend analysis, workflow health monitoring.

✅ Quality & Testing

CI failure diagnosis, test improvements, flaky test detection.

🔗 Multi-Repository

Feature sync, cross-repo tracking, dependency coordination.

Part 4

Prompt Design for Headless Agents

The prompt architecture that separates reliable agents from unreliable ones.

Read the full post →

The Aha Moment

"You don't have to build the engine.
You just have to build the guardrails."

You're not writing a traditional "prompt." You're writing a configuration file for an execution engine.

5 Strategies for Interactive Agents

01

Stop Micromanaging

Define tools + finish line. Let the agent loop natively.

02

Strict Exit Criteria

Use agent hooks to enforce with deterministic checks.

03

Externalize Memory

Write state to files. Crash-resistant. Context-window-safe.

04

Constrain Blast Radius

Explicit tool whitelist. No rogue grep across workspace.

05

Yield Protocols

Define when to stop instead of bashing broken commands.

The Stop Hook

Prompts are suggestions. Hooks are enforcement.

The Stop hook fires when the agent tries to finish. Your script runs a deterministic check — does the file exist? Does it validate? If it fails, the agent gets told exactly what's missing.

The bridge between non-deterministic AI and deterministic automation.

// hooks.json
{
  "hooks": {
    "Stop": [{
      "type": "command",
      "command": "./validate.sh"
    }]
  }
}
// validate.sh returns:
{
  "decision": "block",
  "reason": "output.md missing
    enterprise_slug field"
}

Going Headless

When there's no human at the keyboard, everything changes.

🚫

Don't Yield

Log + terminate. Never ask for input.

♻️

Idempotent

Check if work was already done first.

🔑

Pre-Auth

No browser SSO. Inject tokens before spin-up.

🔄

Loop Limits

Max 10 tool calls. No $50 runaway loops at 3 AM.

📝

Audit Logs

JSON reasoning trail to audit.jsonl.

The Headless Prompt Template

1.<objective>— The specific, narrow task
2.<idempotency_check>— Was this already done?
3.<authorized_tools>— Restricted whitelist
4.<headless_constraints>— No questions, max N loops
5.<failure_protocol>— Log errors, then terminate
6.<exit_criteria>— Definition of "done"
The prompt IS the configuration. Get it right and the engine runs itself.
Part 5

The Future of Developer Compute

Your laptop is about to stop being where work happens.

Read the full post →

The Local Machine Bottleneck

Right now, you're running one agent in your IDE. But where this is going is many agents, working in parallel, each on a different task.

"What happens when you want 5 agents, each in its own isolated environment, each with scoped permissions?"

Each agent needs its own isolated workspace

Different agents need different permissions

Performance — local CPU/RAM can't scale

Security — LLM-generated code on your machine

CI Runners vs Agent Compute

Agents need fundamentally different compute.

CI/CD Runners Agent Compute
Startup~10s+ VM provisionSub-second
StateStatelessStateful, pause/resume
ExecutionFire-and-forgetInteractive, API-driven
ScaleFewer, longer jobsSwarms of short bursts
CostPer-minute VMsMicroVMs, per-invocation

What Agent Compute Looks Like

⚡ MicroVMs, Not Full VMs

Sub-second startup. Hardware-level isolation. Dramatically lower cost per invocation. OCI image support.

⏸️ Snapshot / Resume

Save full state. Hand off to human for review. Resume exactly where it left off. The biggest gap in current CI.

🔑 Scoped Permissions

Per-agent identity and access control. Agent A reads code. Agent B deploys staging. Agent C can't touch production.

🏛️ Enterprise Governance

Auditability, network controls, policy enforcement, cost limits, identity tied to spawning developer.

The Three Compute Layers

The modern dev platform needs all three.

⚙️

CI/CD Compute

Async, stateless, fire-and-forget. → GitHub Actions

💻

Development Compute

Persistent, interactive, human-driven. → Codespaces

🤖

Agent Compute

Stateful, sub-second, swarm-scale, pause/resume. → Coming soon

What To Do Now

You don't have to wait for dedicated agent compute.

1. Start with Actions

Run agents in CI today with Copilot CLI or gh aw.

2. Use GitHub-Hosted Runners

Ephemeral, isolated, zero-maintenance. Ready for agents.

3. Build Prompt Architecture

Design for headless execution now. Be ready when agent compute arrives.

4. Invest in CI/CD Suites

Stronger tests/lint/scan = more autonomy for agents.

The future of compute is converging.
Actions is the foundation everything else builds on. Start there.

AI-Native CI/CD Series by Austen Stone

← Back to austen.info