Copilot’s GitHub Agent Runs on the Actions It Floods

GitHub Copilot’s cloud agent writes code inside GitHub Actions, so every agent task is also a CI job. Pull requests, reviews, and runner minutes now move at the agent’s pace, not the team’s.

Rob Whiteley, CEO of Coder, told Mike Vizard that Git itself is still the right tool and that the platforms wrapped around it were built for a slower cadence. The pressure shows up first on the operational side of GitHub, where Actions, webhooks, and merge rules already run the shop.

Copilot’s Cloud Agent Already Lives Inside GitHub Actions

When someone assigns a task to Copilot’s cloud agent, GitHub does not park the work on a laptop. It spins a short-lived development environment powered by GitHub Actions, where the agent can read the repo, edit files, run tests, and open a pull request.

That design choice is the whole story. The same product that stores the code also supplies the machine that writes the next change. Agent traffic is Actions traffic. If the swarm grows, the queue, the bill, and the blast radius grow with it.

GitHub’s own limits make the coupling obvious. The cloud agent can push only to branches that start with copilot/. Each session has a hard cap of 59 minutes. GitHub treats the agent like an outside collaborator, so Actions workflows wait until a person with write access hits Approve and run workflows. The agent cannot mark its own pull request ready for review, and it cannot merge.

Those brakes still assume a human is in the loop. They also assume the loop is GitHub Actions. Coder has said Microsoft’s Copilot agent uses GitHub Actions for its dedicated containers or VMs, which is the same point in plainer words: the agent is a runner workload with a model attached.

Minutes, Runners, and the Hidden CI Bill

On June 1, 2026, GitHub moved Copilot to usage-based billing and started charging GitHub Actions minutes for Copilot code review on private repositories. The cloud agent already burned Actions minutes plus AI credits. Review jobs joined that meter.

Included credits sit on the seat. Copilot Business includes 1,900 AI credits per user per month. Copilot Enterprise includes 3,900. GitHub raised those pools to 3,000 and 7,000 for the first three months of the new billing, from June 1 through September 1, 2026, then dropped them back. Extra usage bills at published per-credit rates unless a budget cap stops it.

Actions minutes are a separate pile. GitHub Enterprise Cloud includes 50,000 minutes a month. A standard Linux 2-core hosted runner bills at $0.006 per minute once you are past the included pool. Public repositories still get standard hosted minutes free. Private agent work does not.

WHERE COPILOT BURNS ACTIONS MINUTES

GitHub’s agentic-workflow notes put a typical agent job at 1 to 15 minutes, plus about 1.5 minutes of runner setup and a short pre-activation step. That is small until a team lets dozens of agents open pull requests all day, each one kicking lint, tests, and review jobs of their own.

Self-hosted runners can take the minute hit off GitHub’s meter. They also punch a hole in GitHub’s agent firewall, which GitHub says is not compatible with self-hosted runners, so the repo has to disable that firewall to use them. You trade a bill for a wider network path.

GitHub Will Let Copilot Approve a Pull Request

On September 1, 2026, GitHub shipped a public preview that goes past comments. Copilot code review now includes an approval assessment in the overview, and admins can authorize it to sign off on approval. The sign-off can count toward a repo’s required-approvals rule.

The feature is off by default. Enterprise, organization, and repository admins each get a switch, and a repo can limit Copilot to certain file paths. New commits dismiss Copilot’s approval the same way they dismiss a human’s. An assessment alone does not satisfy merge rules. A real approval does, if someone turned it on.

That split is easy to miss in the UI. One line on the pull request is Copilot’s opinion. The other is a merge-gate event. Once a model can satisfy required reviews, the required-approvals setting is the product, not the comment thread. And when a machine-signed merge breaks production, the model is not the one who gets paged.

Whiteley has been making a related claim for months: the hard part is not the model. On September 4, 2026, while announcing Coder Agent Relay with SpaceXAI so Cursor’s cloud agents can run on a customer’s own machines, he put it in one run-on sentence.

Enterprises never rejected AI agents. They rejected the deployment model. The model was never the bottleneck. What has kept this work out of production is everything that comes after the pilot: where the code runs, who has access, what the agent can reach, and what record exists afterward.

Rob Whiteley, CEO of Coder, Coder Agent Relay announcement

Coder sells self-hosted cloud development environments, so the quote is also a pitch. The underlying question still stands even if you never buy Coder. GitHub already answered “where the code runs” with Actions. “Who has access” is now a set of admin toggles, including one that lets Copilot approve the change.

What Still Stops an Agent From Merging to Main

GitHub has not handed the coding agent the keys to protected branches. The remaining brakes are specific, and they are also the list of things an admin can weaken.

BRAKES THAT STILL APPLY TO THE CODING AGENT

• Branch prefix: The agent can create and push only to branches that start with copilot/, and branch protections still apply.
• Write access: Only users with write permission can assign it work, and it ignores comments from everyone else.
• Outside collaborator: Draft pull requests wait for a write-access user to approve Actions, and the person who asked for the pull request cannot approve it.
• No self-merge: The coding agent cannot mark the pull request ready, cannot approve it, and cannot merge it.
• Time box: A session dies at 59 minutes and cannot be extended.
• Firewall: Outbound access is allowlisted by default, with a warning posted on the pull request when a call is blocked.

GitHub documents the gaps in that last control in plain language. The firewall does not apply to MCP servers, or to processes started in Copilot setup steps. It only wraps processes the agent launches through its Bash tool, and only inside the Actions appliance. GitHub also warns that a sophisticated attack may bypass it.

On March 13, 2026, GitHub added a repository setting that lets admins skip the human approval so workflows run as soon as the agent pushes. The default is still the hold. The escape hatch is there because waiting on a person slows the agent’s test loop, which is the entire reason teams bought the agent.

3.2 Million Users Showed Up in One June Week

Microsoft Azure Research sampled GitHub Copilot coding-agent traces from the first week of June 2026. The paper, “Agentic Coding in the Wild,” logged 13.5 million Copilot sessions in one week from 3.2 million users, across more than 27 models and 45 tools.

ONE WEEK OF COPILOT TRACES IN JUNE

• The loop: 760.5 million LLM calls and 774.7 million tool calls, almost one tool per model call, with 87% of the LLM calls started by the agent rather than the user.
• The tokens: 44.9 trillion prompt tokens, with a 50 times spread across users, from about 23,000 tokens per turn to 1.1 million.
• The time: Median session 4.2 minutes, mean 62.6 minutes, median 15 LLM calls per session and a mean of 40.6.
• The waste: Tool failures in 9% of turns can drive up to 4 times the compute through retry loops, and cache hits fall from about 90% inside a turn to 55% at a turn boundary and 8% after a model switch.

That is not a chat workload. It is a long chain of model calls glued to tool runs, with idle gaps of minutes between turns. The paper’s point is that serving systems built for single requests throw away the structure of the session. GitHub’s point, whether it likes it or not, is that the same chain also lands on Actions runners, pull-request notifications, and review queues.

GitHub COO Kyle Daigle said in April 2026 that commits were on track to hit 14 billion in 2026, up from 1 billion in 2025. In our earlier reporting, GitHub’s Actions load had already reached 2.1 billion minutes in a single week in April 2026, against 500 million minutes a week in 2023, about 4.2 times the older pace. CTO Vladimir Fedorov later told staff that June was GitHub’s best month on record, after the June 1 billing change, while Microsoft added extra capacity, including from AWS, to keep the platform up.

GitHub has spent the same stretch pushing people to manage many agents at once. The Copilot app now treats a developer as someone routing work across a fleet, which is how GitHub has been turning developers into AI fleet managers instead of single-thread pair programmers. More agents per person is more Actions jobs per person.

Issue Comments Became a Control Channel

Because the agent reads issues, pull-request titles, and review comments as instructions, those text boxes are now part of the execution path. In April 2026, researchers described a prompt-injection class nicknamed Comment and Control that used GitHub issue and pull-request text to steer coding agents, including Copilot’s agent, Claude Code, and Gemini CLI, toward secrets in CI.

GitHub’s answer has been layers, not a claim that injection cannot happen. Tokens for the coding agent are limited. Pushes stay on copilot/ branches. Workflows wait for a human unless an admin skipped that wait. On July 28, 2026, GitHub Actions began holding some workflow runs on public repositories when it thinks the workflow looks malicious, until a write-access collaborator approves it from a logged-in browser session.

GITHUB AGENT CONTROLS IN 2026

1. March 13, 2026: Repository admins can skip the Approve and run workflows step for Copilot coding-agent pull requests.
2. June 1, 2026: Copilot moves to usage-based AI credits, and Copilot code review starts consuming Actions minutes on private repos.
3. July 2, 2026: Copilot CLI in Actions can use the built-in GITHUB_TOKEN instead of a long-lived personal access token.
4. July 28, 2026: Actions holds some public-repo workflow runs that look malicious until a write-access user approves them.
5. September 1, 2026: Copilot code review can submit a real approval that counts toward required reviews, off by default.

Read that list in order and the human is still present, but the places where a person must click keep shrinking. A PAT leaving the building is good news. A model that can satisfy a required review is a different kind of news. Path filters and an off-by-default switch are the current answer, not a promise that the switch stays off.

Whiteley Wants Agents Off the Laptop

Whiteley’s interview argument matches the product he sells. Distributed version control can handle lots of commits. The wrapped platform cannot, he says, unless execution is isolated, policy-aware, and audited. Coder’s bet is that enterprises will move both people and agents into short-lived workspaces the company already runs, instead of letting a vendor-hosted agent sit on GitHub’s shared runners with a GitHub-shaped firewall around it.

On September 4, 2026, that bet got a concrete shape: Agent Relay, so Cursor cloud agents keep Cursor’s loop while the workspace stays on the customer’s cloud, VPC, or on-prem gear. Whiteley’s line about where the code runs, who has access is the same list GitHub now exposes as settings pages, credit pools, and runner labels.

GitHub is not standing still. It added agent secrets separate from Actions secrets, MCP allowlists in enterprise managed settings, a Copilot usage-metrics API that breaks out third-party agents, and repository-level reports for pull requests the cloud agent opened. The platform is learning to count the swarm because the swarm is already on the bill.

The merge button is still a human’s, unless an admin gave Copilot a vote that counts. Until that approval switch is on, Copilot’s new assessment is still a comment on the pull request, sitting on a runner GitHub already owns.