Realtime multiplayer, automation, and you!

[upbeat music] We're gonna start one minute early, which gives me one extra minute, and then anybody who came on time is, uh, gonna miss the super enthralling introduction.

Hi, my name's Idan. Nice to meet you all. Uh, I lead GitHub Next, which is the labs team of GitHub. I like to call us the Department of Fool Around and Find Out, but I usually don't say the word fool.

We're the team that created Copilot, uh, and pioneered a ton of areas since then, right? Uh, spec-based programming, natural language to app, lots more. Not everything, uh, that we do turns into a finished product.

Our job is to sort of explore the future and scout it out. Um, but our job is to reach for the GitHub that's gonna be next year, maybe not tomorrow's GitHub, but, uh, the tools that we're all going to use to make software a year from now, two years from now.

That's pretty hard, 'cause my crystal ball barely works into, uh, next week. Uh, and we're really fortunate that we get to do most of our work in the open, so you can check out githubnext.com and our socials, which we occasionally remember to post stuff to.

And what we do isn't really research, right? Because the only way to know what's gonna be good, uh, is to make stuff. So we make a lot of stuff, and the hard part about being an undirected research team is always the question of, what's worth our time?

Even if you're a token billionaire, uh, even if you have ten terminals running Fable night and day, then opportunity cost is, is still there. It's everything. Uh, so if in, in a world where the, uh, marginal cost of a line of code is approaching zero, uh, and AI can help us to think and to make, what do

we make, right? How do we even choose what's important, uh, when the market is super noisy and the tech changes every week? Um, and this isn't even really a Next problem anymore.

This is an all of us problem now. Uh, we're all labs teams now. Uh, and the way that Next thinks about this stuff is to look for durable themes, things that will be true no matter what, uh, the technology of this tomorrow.

And I think that the theme of this moment, uh, uh, is very much an evergreen one, right? It's AI started with a surge of personal productivity, right? The LLMs completed what I type, and the agents go fetch me the thing that I need.

And now I have many agents helping me to parallelize myself, but the greatest value doesn't come, uh, from multiplying me into more me. Uh, it comes from enabling groups of people to do more.

That's always been true. And we're thinking about how to accomplish that through two lenses. Every industrial revolution, uh, came about through automation, right? It's funny to think about our giant software industry as being pre-industrial, but on some level it is, because until now, the only automations that we had were heuristics, like make sure there's a semicolon at

the end of every line. Um, but now AI can help us to automate things that require some amount of basic judgment and intelligence. And there's no magic trick to making great software, right?

It costs time. Uh, and we can buy that time by automating away the things that we used to need to do manually. Like, the more we automate, the more time we have to spend on craft or on our product or on making it really good or on features, right?

Either you hire more people, or you automate away part of what your people are currently doing in order to spend that time. Uh, and at the same time, how are we gonna work together, right?

How does collaboration look like in the future? Whoops. Oh, well, sorry about that. Um, yesterday, uh, Jeffrey Lid talked about understanding being the bottleneck, and that's very true at a me level.

Uh, but my personal understanding was never sufficient for shipping code inside a team, right? Our understanding at an us level can only happen at the end of the process.

Um, sorry, uh, uh, uh, it can't only happen at the end of the process, uh, when the process happens so much faster. So going faster means that a small misalignment, uh, can snowball into a ton of wasted work, uh, and that work costs tokens, and tokens cost real money now, so, uh, on top of the time that

you're misspending. So today, I'll give you a quick tour of two prototypes that we're working on at GitHub Next in each of these themes. Agentic Workflows is our take...

Why is that not there? Oh, I had to click again. Uh, Agentic Workflows is our take on how automations should work in an agentic world, and Ace is a prototype that explores what real-time multiplayer software development looks like.

So I'll start by showing off Agentic Workflows, and it requires me doing this. Okay, cool. Uh, this is my personal website. Not that interesting. I'm showing it to you.

This is like Chekhov's gun. We're gonna see it again later. Um, and my personal website is built with this framework called Astro. Astro is a great web framework. The greatest part about it is that they release, like, fifty things a month, which means that I'm constantly on the upgrade treadmill.

And there's a great GitHub product called Dependabot, which notifies me when my stuff is out of date. Um, but the problem is, is that when I do these upgrades, I frequently need to make code changes.

So what I really want is a kind of super Dependabot that's always there, automatically looking in the background at my dependencies and figuring out how to upgrade me, including the code changes, the breaking changes.

Um, and because I'm lazy, and I like not doing work, um, I used Copilot, uh, to create an agentic workflow. And there's this magic line up top where I supply effectively a skill, saying like, "Hey, create an agentic workflow.

Here's a document that tells you everything you need to know about that." Uh, and then what comes below that is something a lot like a Slack message that I'd send to a junior developer on my team.

Like, "Every day, I want you to check if there's a new release, look at the change log, look at the docs, come up with a plan for the upgrade, uh, and then create a PR with the thing, and here's the links to the docs."

Right? This is like a message that I would send to somebody on my team. Go write a playbook. And when I, uh, went and created this, it did go and create a playbook.

In fact, that's what Agentic Workflows kind of look like. They look like Markdown documents. Like, if GitHub Actions and Copilot had a baby together, uh, and it ran on Markdown, this is what it is.

So what does this, uh, uh, uh, Agentic Workflow look like? Well, you know, it's, uh, an upgrade checker. It's got my tasks. Step one, check for new releases. Again, because it sees my code base, it was able to infer what it even needs to check, and it actually found these specific dependencies.

Review the change log and the upgrade guide, apply the upgrade, uh, and then create a pull request, right? I didn't ask for any of this that explicitly, but it turns out that Copilot's pretty good at sussing out my little three-line message into a full playbook.

And then at the top, I've got this special section. This is the, uh, what we're calling... Oop, no, don't collapse it. Oh, man.

Scrolling is wonky when you zoom in. Uh, this YAML front matter. This is where we stick the guardrails, 'cause if we're gonna be not supervising agents doing things, then we're gonna need much stronger guardrails around what they're allowed to do, what they're allowed to read, what they're allowed to write, uh, and where are we gonna specify that?

And it's not enough to just prompt the agent and be like, "Listen, bro, I don't want you to buy Bitcoin for me ever." That's not enough, 'cause somebody else can prompt inject the agent and take it in a direction that you don't expect.

So any of the guardrails, if you're prompting the guardrails at the agent, you're effectively letting the fox loose in the henhouse. It's not actually a guardrail. Um, so here, uh, you can see that I'm specifying deterministically, like, my permissions are read all, what tools am I allowed to use, uh, what network, uh, requests is it allowed to

make. It's not allowed to just go to bitcoin.com or whatever. Uh, in fact, it's only allowed to go to some specified set of default websites, the npm ecosystem, 'cause it's gotta check for, like, you know, what's new, GitHub, and of course, the Astro docs, which I specified in my original prompt.

Um, and I've got this block called safe outputs, which is basically saying, these are the only things that the agent is allowed to write. And so I'm saying, in this case, the agent is a- allowed to create pull request.

Pull request, single, uh, because I don't want the agent to get prompt injected to create five hundred pull requests. That would be a denial of service. Um, or, and this is the other thing I explicitly said, you're allowed to do nothing, right?

Which sounds silly, but it actually matters because in a world where I have lots of automations, the last thing I want is noise. I don't want the agent's denial of servicing me.

So okay, I've created this and I've run it, and this is actually my actual automation on my actual personal website. I didn't ask for any of this, but it did a pretty good job of, like, saying, "Hey, here's the highlights of what you get from going from this version that you're currently on to the version that is

the target," right? It's read all of the release notes in the middle. This is normally what I would do as a human. Uh, and it's built me, like, you know, sort of like a tailored description.

It's figured out there's no breaking changes. It's actually verified this by running and building my project. And because I happen to have this deployed to Cloudflare, um, or whatever, anything with preview deploys, I can click that open and see that nothing has changed in my website, which is exactly what I want, right?

Like, it's done the upgrade, and I see that it still works exactly as it did before. But this was, like, a minor point release. That doesn't really count. Let's look at a major upgrading change.

And actually, I'm lucky that Astro just released Astro 7, because this is actually jumping two major revisions from 5 to 7. And so now it's saying like, okay, Astro 7 has brought me all of these things, and Astro 6 would've brought me all of that stuff, but I neglected to do the upgrade so I could have a

cool demo for you all. Uh, and it's found all of the code changes that were broken, and it updated them. Uh, it also, uh, verified that the build runs, and it also highlighted manual steps, uh, that things that I would need to do later.

Um, uh, and again, you know, if I go down here and I click on this, I can see, hey, still works. So cool. Now, uh, it's just Markdown. It's easy to iterate on that Markdown, right?

If you don't like the way that the automation works, just edit the English. It gets recompiled into an actions workflow. Like, the Markdown is the source code. The YAML is like a compiled artifact.

You never look at it. Um, but we've also given you a whole library of Agentic Workflows for you to use as a starting point to customize. So an issue triager.

Internally, GitHub has actually used this as the basis for, like, spiking out our own internal issue triager or for, like, hunting down N+1 queries in our, like, monolith or all kinds of things.

There's a ton of things that are super helpful that way. Repo Assist, this is actually a swarm of, uh, uh, Agentic Workflows that work together to help you maintain your project by finding low-hanging fruit, fixing them, identifying tickets that need nudging or feedback that you need from people who have filed issues, whatever.

CI Doctor, how many times have you responded to a busted CI run by just running it again? All of us. Anybody who hasn't raised their hand is lying. Uh, uh, a, a million more, like, you know, goals, sure, uh, daily team status and repo status.

If I want this to go do, like, homework on the internet, I can. So this is not just for engineers. This is also for product managers whose job it is to look at information over here and summarize those tickets over there, right?

We can start to get everybody involved in automation. That's how you actually get industrial scale.

Uh, so, uh, that's Agentic Workflows. Um, the security guardrails, we have sort of four principles that we believe, uh, everybody should burn into their brains. Uh, defense in depth, one layer is never enough.

Uh, that was always true. Never trust agents with secrets. If an agent can know a secret, that secret, you need to treat it as if it's already been compromised, um, because you have no idea whether or not somebody's injected the agent to reveal that secret somewhere else.

So if an agent can see the secret, um, it's bad. In Agentic Workflows, the secrets are all kept outside of the agent's jail, and when the agent wants to-

Use the secret to call something, it needs to ask the warden, "Hey, Mother May I? Please go talk to that service." Uh, stage and vet all writes just so that it's auditable, and log everything just so that it's auditable.

Uh, and when we give this to existing projects like the Home Assistant project, which is a huge open source project, um, the first, uh, agentic workflow they built was something that looks at every submitted issue, walks the Python stack trace to figure out if the bug is in first party code or third party code, closes the issue

if it's not their issue, right? That's something that was not possible before AI, not possible with heuristics, uh, but is possible now.

Agentic Workflows is in public preview today. You can go and kick the tires. So go ahead, go wild. Uh, we actually believe that this is gonna be a bigger category than interactive AI because automations that run in the background while you sleep, that's the ball game.

Okay, so let's talk about the collaboration piece. So this is how we've always built software, right? Because the cost of writing code was so high, uh, but that's not true anymore.

We would plan and review together, but the building part was done alone. Like, you know, illuminated by the light of my monitor, uh, I would build. But now none of it is alone, right?

Planning isn't before, and review isn't after. We iterate on the direction together, and AI takes a step, and then we iterate more in the direction. So what's an interface that makes sense for that style of development?

I'm only slightly trolling, right? Slack was designed to be better, uh, than email for the average office worker. It was never designed for making software or the needs of everyone involved in that.

But what this is good for is surfacing all the facts that are not in code. Anything that's in code, any fact that's in code, the agents can figure out by reading the code.

What's left are the things that are not in code, like political considerations. Like, A, if we do it that way, that VP over there is gonna vibe with that direction.

Or like, we should make it purple because that's their favorite color. Or we get a really sweet deal, uh, on infrastructure from Azure, therefore we should be building on Azure, not on, uh, GCP or AWS.

Whatever. But the biggest win is the same one that we've already seen over and over, right? I don't email Word documents around anymore. I create and collaborate in the same surface, in the same place.

This is coming for code a trillion percent, right? So let me show you what we have here. Oop, here we go. I gotta find the tab. All right. Uh, this is Ace.

Let's switch to the repository. So Ace looks an awful lot like Slack, right? And over here on the left, I've got sessions, and I can create new ones. And, you know, so far this kinda looks like every other conductor-like product out there.

Um, the difference being is that every one of these is not on my machine. In fact, none of this is running on my machine. It's all micro VMs in the cloud.

So every session is just a branch of my repo checked out to a spot in the cloud. Uh, and I can create them and do stuff in them, and talk with my teammates.

So like, uh, "Hey, um, uh, what's your favorite color?" Right? Uh, and meanwhile, I'm gonna like install my dependencies, and then when that's done, I'm gonna do like, uh, bond dev.

I'm gonna run the dev server. Um, and here, like Russ and I are having a discussion like, "Are you sure? Maybe,

uh, maybe green is calmer." Um, oh, nope, I sent that as a terminal command. Good job, me. Um, I do not want that as a thing. Great. I'll do it like this.

Uh, and I can open up my preview. Whoops. Give me a preview. I'd like a browser preview. Okay. So, so far, not that different from developing with any sort of like multiplayer tool.

And here I've got this sort of calm Hacker News thing. I've just had a whole discussion with my teammate. I don't wanna turn around and now like emit those instructions again.

Instead, I just wanna be like, "Yo, Ace, do it." Uh, and because it sees the entire back stroll of my conversation with my peers, with my team, it's able to act on that, uh, uh, on, on that chat history.

And if the Wi-Fi was nice, then it would be doing it faster. Um, but you're gonna have to trust me on this because I don't have enough time to wait for this, that it's going to just respond to the fact that we had a discussion about colors.

And AI is also really good at fishing out that final state. Like very frequently, what do engineering conversations sound like? They sound like, like, "Hey, we should try it this way.

No, wait, I thought of like an edge case. We should actually do it that way. Let's go back to the first idea," right? But instead of me sort of like figuring, teasing out that final state from that long conversation, I can just let AI do it, and it'll figure it out.

So I don't need to work for the robots. And sometimes we have things that are a lot more, um, complicated. Like here, I wanted to add selectable timeframes to my app, and so I asked it to make a plan, and that plan comes as a, uh, Markdown document.

Uh, but this Markdown document is not just for me to look at and edit, it's for us to look at and edit together. So Russ is somewhere, uh, here in this document and like, you know, maybe he thinks that we should add an all time, and I'm gonna get rid of the today, and here I can again

do like, uh, we've updated the plan. Do it. Um,

uh, uh, and it'll just respond to the plan that we've edited together. And as we see now, we're moving to this future where, uh, more and more of the work that we're doing with AI results in documents like Markdown documents in a docs folder that capture sort of the truth.

And maybe more and more in the future we're gonna be editing those documents as the way that we do development. Like in order to change something about my application, I'm gonna edit a document and I'm gonna tell AI, "Hey, make the document true."

So this shared document editing is not just like, oh, nice to have. Maybe this is actually sort of the, uh, interface that we like to work in. But there's also the, uh, social coding aspect.

Right? Like, if I'm working with other people on my team. Um, remember when that was a thing that was a tagline under the GitHub logo? Um, so, uh, how can it help me stay up to date with what everybody else on my team is working on?

Like, it's not just enough to have, like, real-time multiplayer. I also wanna be ambiently aware of what everybody's going, going on about. So Krzysztof is working on VM tooling.

This is actually work that we're doing on Ace. And Maggie wrote this dashboard and hard-coded her name, and so that's why we're looking at Maggie's name. Um, and David worked on whatever.

All this stuff to help me stay aligned with my team. And when I look to the future, I'm starting to think about, how do automations surface themselves in this if I wanna talk with my automation?

Uh, there's lots of things that I wanna do in this kind of interface, like when an agent wants to tap me on the shoulder and ask me a question, um, that I think are very interesting.

So that's a short Ace demo. We're going through this weird inversion of our relationship with the agents. Like, the better that we get at articulating, uh, our goals to the agents, the less they need us.

Uh, and as the models get better, they're also good at spotting, like, underspecified behaviors and then asking us to clarify. Uh, and then whenever they need a pair of hands, they can ask us to be the pair of hands.

But either way, the interfaces now have the ability to support the ability of agents to listen to everything and invoke us when they need it, which is a little funny to think about.

It's maybe, like, sort of we're coming at it from this side, and, like, OpenClaus coming at it from this side, but, like, we're landing in sort of a similar spot.

And I'll close with this thought. Um, for the past few years, AI has helped me to type, but if you look at the science of the matter, it's only about 5% of the job.

Like, this was a longitudinal study conducted on, like, 100 developers over thousands of hours. Turns out that the hands-on-keyboard typing part is 5% of the time. Now AI has to help me with the other 95%.

Where is the system that I wanna touch? How does it work today? What do other people think about, like, how we could mutate it or should mutate it? When AI can discover anything in my code base, like, how do we, how do we help scale up all those other things, right?

Like, not just the 5%, which is what all the tools have been helping us to do so far. So that's Ace, and that's Agentic Workflows. Uh, please, uh, come by and talk to us.

Uh, we have, uh, a booth down in the Microsoft booth because we're a Microsoft company. Uh, and you can find us on the socials and githubnext.com. So if any of this resonates and you're interested in it and you wanna give it a shot, Ace is gonna be in technical preview hopefully later this month, and Agentic Workflows is

already out there for you to kick the tires, and we'd love to hear from you and how you wanna use this. Thank you so much. [audience applauding] [upbeat music]