GitHub Agentic Workflows

Very weird of them to not use github.com but instead use the domain they otherwise use for non-github/user content. Phishy indeed, and then people/companies go ahead and blame users for not taking care/checking, yet banks and more continuously deploy stuff in a way to train users to disregard those things.

Re: GitHub Agentic Workflows

#6

Post by lemonlime227 » Sun, Feb 08, 2026, 3:12 PM UTC

Alternative, less phishy link: https://github.com/github/gh-aw

This is on GitHub's official account. For some reason GitHub is deploying this on GitHub pages without a different domain?

Re: GitHub Agentic Workflows

#7

Post by rendx » Sun, Feb 08, 2026, 3:12 PM UTC

TZubiri wrote: post #4

Not confirmed that it's by Github, phishy domain.

Agreed, but looks like it: https://github.com/github/gh-aw

Re: GitHub Agentic Workflows

#8

Post by throwup238 » Sun, Feb 08, 2026, 3:17 PM UTC

TZubiri wrote: post #4

Not confirmed that it's by Github, phishy domain.

Why is it phishy? Github.io has been the domain they use for all GH pages for a long time with subdomains mapping to GH usernames. It’s standard practice to separate user generated content from the main domain so that it doesn’t poison SEO.

Re: GitHub Agentic Workflows

#9

Post by ewuhic » Sun, Feb 08, 2026, 3:28 PM UTC

Go: check

YAML: check

Markdown: check

Wrong level of abstraction: check

Shit slop which will be irrelevant in less than a year time: check

Manager was not PIP'd: check

Re: GitHub Agentic Workflows

#10

Post by clarkdale » Sun, Feb 08, 2026, 3:28 PM UTC

I feel like this solution hallucinated the concept of Workflow Lock File (.lock.yml), which is not available in Github Actions. This is a missing feature that would solve the security risk of changing git tag references when calling to actions like utility@v1