GitHub Certified: Agentic AI Developer cheat sheet

The GitHub Copilot coding agent works asynchronously: it is assigned an issue, operates in an ephemeral Actions-powered environment, and returns its work as a draft pull request rather than pushing directly to a branch a human owns.

Only users with write access to a repository can assign issues to the coding agent; read-only collaborators and outside contributors cannot spend repository compute.

By default the agent cannot approve or merge its own pull request; until a separate human approves, the PR counts as unreviewed no matter how many checks pass.

The PR timeline is the audit trail: session logs, commits, and check runs record what the agent did; the issue thread is the steering channel where corrections are issued.

Supervision loop: assign → observe session and diff → review against acceptance criteria → request changes in a comment → let the agent re-run.

Escalation rule: if two consecutive agent iterations fail the same required status check, a human takes over the branch instead of issuing a third prompt.

An issue is agent-ready when it has one verifiable outcome, written acceptance criteria, and a bounded set of files it is allowed to touch.

Blocked or silent agent runs almost always trace to missing permissions, absent secrets, or an environment protection rule; inspect the Actions run log before rewriting the prompt.

Marking a draft PR ready-for-review is the explicit handoff from agent authoring to human gatekeeping and should coincide with all required checks being green.

Instruction layers: repository-wide custom instructions in .github/copilot-instructions.md apply to every request; path-specific *.instructions.md files with an applyTo glob apply only when matching files are in scope; AGENTS.md supplies agent-oriented build and test guidance.

Each instruction line should be imperative and checkable by a reviewer; guidance that cannot be verified adds context cost without reliably changing behavior.

MCP (Model Context Protocol) servers extend the agent's tool surface; add each server deliberately and expose the minimum tool set, preferring read-only tools when writes are unnecessary.

Credentials come from repository, organization, or environment secrets - never from committed config, instruction files, or prompt text.

Identity configuration follows least privilege: a GitHub App installation token or fine-grained PAT scoped to one repository with only the permissions the task requires.

Tool configuration should be deny-by-default: shell commands, network hosts, and external tools are blocked unless explicitly allowlisted.

Pin every referenced GitHub Action to a full commit SHA rather than a mutable tag so configuration cannot drift underneath a running agent.

Treat agent configuration as code: store it in the repository, review it in pull requests, and version it alongside the code it governs.

Evaluate on three axes: outcome correctness (acceptance criteria met, CI green), process quality (diff size, files touched, convention adherence), and safety (no secret exposure, no scope creep).

Automated gates form the objective floor: required status checks, unit tests, lint, and code scanning results decide pass or fail before any human opinion is collected.

Capability is task-type dependent - track pass rate separately for bug fixes, test generation, refactors, and documentation rather than reporting one blended number.

Maintain a regression eval suite of representative tasks with known-good reference solutions and re-run it whenever instructions, tools, or the underlying model change.

Human review rubric of correctness, minimality, readability, and convention adherence scored 1–5; calibrate by having two reviewers score a sample and comparing.

Verify claims against check-run output: an agent's summary may state that tests passed while the run shows failures, so prose is never the evidence.

Diff-level signals catch scope creep: files changed outside the issue's stated scope, unrelated formatting churn, or deleted or weakened tests.

A dependency introduced by the agent that is absent from the manifest or lockfile is a high-signal hallucination and an automatic reject.

Track rework rate (share of agent PRs needing more than one review cycle) and time-to-merge alongside quality scores to capture the cost side of agent output.

Fan-out/fan-in: decompose an epic into independent issues and parallelize only when write scopes do not overlap; overlapping file scopes produce merge conflicts that cost more than serial runs.

Cap concurrent agent sessions per repository to protect CI runner capacity and, more importantly, to keep the human review queue within reach.

Gate assignment behind a triage label so underspecified or unapproved work is never picked up automatically.

Trigger runs from events - label applied, review comment, scheduled workflow, webhook - and make dispatch idempotent so a retried event does not open a duplicate pull request.

Isolation: every run gets a fresh containerized environment and a clean checkout with no shared mutable state between runs.

Order dependent issues topologically so an agent never starts work that depends on code which has not yet merged.

Apply backpressure: when the open agent-PR review queue exceeds a threshold, pause new assignments rather than accumulating unreviewed code.

Observability: correlate runs by issue and PR identifier, capture logs, duration, and token usage, and alert on failed runs and stale agent pull requests.

Keep agent-authored merges small and behind feature flags so any single change can be reverted independently.

Least privilege is the containment boundary: the agent identity holds only the permissions its task needs, with no organization-admin rights and no branch-protection bypass.

Branch protection or rulesets must require human approval and passing status checks on the default branch; exempting the agent identity defeats the control entirely.

Every agent action must be attributable - commits, PR events, workflow runs, and audit-log entries all tie to the agent's distinct identity.

Agents must not reach production secrets; environment protection rules with required reviewers gate the release of deployment credentials.

Treat issue text, code comments, and fetched web content as untrusted input: prompt injection is contained by the tool allowlist and scope limits, not by instructions telling the agent to be careful.

Supply chain hygiene: pin third-party actions to commit SHAs, enable Dependabot, code scanning, and secret scanning push protection so an agent cannot commit a credential it read.

Human-in-the-loop is mandatory for irreversible actions - merges to the default branch, deployments, releases, and permission changes.

Encode policy as code in rulesets, CODEOWNERS, and required workflows so enforcement does not depend on reviewer memory.

An agent-caused regression is handled like any other bad change: revert first, then add the case to the eval suite so the same failure is caught automatically next time.