Weekly DevOps Roundup: Agent Workflows and Secure Releases

by TechHub

GitHub Agentic Workflows is now generally available, turning natural-language Markdown into GitHub Actions workflows with read-only default permissions, sandboxing, and validated outputs. Copilot Fusion and paid-plan Copilot Memory also reached general availability, while agent sessions can now continue across editor, CLI, web, and mobile clients, giving teams more persistent context and continuity across repositories. Azure Arc Automatic Agent Upgrade reached general availability, Azure Developer CLI added deployment previews and extension-aware pipeline generation, and Azure DevOps Server 26H2 RC opened a supported path for upgrade testing. Marketplace Trusted Publishing lets extension publishers replace long-lived tokens with temporary or federated credentials, while PHP2Shell guidance makes clear that customers must patch PHP installed by pipeline steps or bundled in custom images. The week's releases pair broader agent automation with explicit permissions, release validation, and operational ownership.

This Week's Overview

GitHub expands agent development across repositories and clients

GitHub's Universe announcements connect agent sessions, repository automation, shared memory, and code review. The releases have different availability and billing requirements, so teams should distinguish generally available capabilities from previews and organization-controlled rollouts.

Adoption figures and the Copilot platform

GitHub recorded 17.9 billion pushes, 34.3 billion commits, and 1.3 billion merged pull requests in the year ending September 30, 2026. In September, more than 40% of pull requests started with a detectable agent's first draft, up from 17% in March. Among Copilot users who explicitly selected models, 61% used more than one model across their September sessions.

Copilot Fusion is now generally available, combining model orchestration with automatic selection for individual task steps. These figures make review and security controls an important counterpart to agent-generated work: GitHub reported 5.8 billion push-protection scans this year and more than 90% year-over-year growth in GitHub Advanced Security usage.

Copilot app, multi-repository projects, and code review

The GitHub Copilot app brings together projects supporting fully managed, parallel agent sessions across multiple repositories. The Universe presentations cover connectors, Canvases, cloud sandboxes, and cross-surface continuity, alongside architectural work on GitHub's core infrastructure. GitHub Enterprise customers can now use all Copilot features without a separate subscription, paying for the AI credits they consume.

GitHub reported that Fusion Max scored within two points of Opus 5.5 Max at half the cost and 40% less time per task. It introduced Copilot code review Max, which posted the highest F1 score on ReviewBench for high-severity issues. These are specific evaluation results, rather than guarantees for every repository, so teams should assess cost and review quality against their own workloads.

The infrastructure announcements provide context for those managed workflows. GitHub reported adding 4 million CPU cores, 160 PB of high-speed storage, and 50 Tb/s of network capacity this year, while the keynote recaps describe rebuilding infrastructure underneath Git.

Agent sessions continue beyond editor windows

Cloud agent sessions can now continue across VS Code, the GitHub Copilot app, GitHub Mobile, github.com, and Copilot CLI. Agent Host Protocol 1.0 lets clients connect to independent sessions and stay synchronized, while Agent Host keeps sessions independent of VS Code windows. Remote sessions still depend on the remote machine and its Agent Host remaining running.

The Copilot harness, built on the Microsoft Copilot SDK and combining the Local VS Code and Copilot CLI harnesses, is the default for new editor and Agents window sessions. The Agents Window manages parallel work across workspaces and environments, including remote machines reached through SSH or dev tunnels.

Several related capabilities remain less mature. Parallel model comparison is in preview, desktop computer use is experimental and requires approval for each application, and connectors are in preview on all Copilot plans. Business and Enterprise administrators must allow Editor preview features before users can use those connectors.

Agentic Workflows reaches general availability

GitHub Agentic Workflows is generally available on github.com for GitHub Free, Team, and Enterprise. Natural-language Markdown files compile into standard GitHub Actions YAML, allowing teams to reuse existing runner groups and policy constraints. Workflows can use Copilot or another coding agent, but the default Copilot CLI engine requires a Copilot license.

The execution model includes read-only default permissions, sandboxing, an Agent Workflow Firewall, validated safe outputs, and threat detection before changes are applied. Additional options include Actions Runner Controller with Docker-in-Docker, per-workflow model providers, model routing, and Cloud Hypervisor or NVX micro-VM isolation. Teams can therefore evaluate agent automation within their existing Actions infrastructure while reviewing the permissions and isolation appropriate to each workflow.

Shared Automations gains repository-level ownership

Shared Copilot Automations are rolling out to Copilot Pro, Pro+, Max, Business, and Enterprise users, with availability varying during rollout. Repository readers can view shared automations, while users with write access can create and edit them. Automations remain with the repository when their creator leaves, making them less dependent on an individual's continued membership.

AI credits are billed to the repository owner, and GitHub actions are attributed to Copilot. Organization administrators must enable the “Allow use of Copilot cloud agent billed to the organization” policy before shared automations can run. Teams should choose the automation type carefully because it cannot be changed after creation.

Memory and repository context become persistent

Copilot Memory is now generally available on paid plans, retaining personal preferences and repository conventions across sessions and clients. GitHub code search gives Copilot access to code across repositories without local clones, supporting exact text, symbols, regular expressions, and semantic search. Together, these capabilities reduce the need to repeatedly supply working conventions and locate relevant code manually.

Copilot dreaming is in public preview for personal memory curation, repository customization, and code review customization. It is opt-in, consumes AI credits, and proposes changes to checked-in skills and instructions through pull requests. Among reviewed preview CLI sessions using memory, 93% showed better preference adherence and 42% showed more efficient workflows attributed to included memories, results specific to that reviewed sample.

Azure Arc adds managed upgrades and an incident-investigation pattern

Azure Arc coverage addresses both agent maintenance and the telemetry needed to investigate on-premises incidents. Automatic upgrades are generally available, while the Azure SRE Agent article describes an architecture and pilot rollout approach.

Automatic Agent Upgrade removes a recurring maintenance task

Automatic Agent Upgrade is now generally available for Azure Arc-enabled servers. When enabled, Microsoft manages Azure Connected Machine agent upgrades to the latest version, rolling them out in regional batches during off-peak hours. This lets administrators delegate agent updates rather than manage each upgrade themselves.

A built-in Azure Policy can enable the setting across an assigned scope and remediate machines that are not configured. New onboarding can use azcmagent connect --enable-automatic-upgrade, or administrators can select Automatic Agent Upgrade in portal-generated scripts. Existing estates can use policy enforcement, while new machines can enter service with the setting already enabled.

On-premises incident investigation starts with telemetry and permissions

The proposed Azure SRE Agent architecture uses Azure Arc to expose on-premises Windows and Linux servers as Azure resources without moving their workloads. Azure Monitor Agent and Data Collection Rules send metrics and logs to a Log Analytics workspace, and Azure SRE Agent uses alerts and defined response plans to investigate incidents.

Examples cover SQL Server crash diagnosis, cross-platform patch planning, inventory changes, and SQL Best Practices Assessment results. The rollout guidance puts telemetry verification, action permissions, and approval responsibilities ahead of expansion beyond pilot servers, providing a practical boundary between collecting evidence and authorizing operational changes.

Azure Developer CLI improves deployment inspection and pipeline generation

The October Azure Developer CLI recap covers releases 1.35.0, 1.35.1, 1.36.0, 1.37.0, 1.37.1, and 1.37.2. The updates affect both deployment workflows and custom integrations.

Preview deployments and check express-mode constraints

The azd deploy --preview command inspects deployment operations without deploying and supports structured JSON output. That gives developers an inspection step they can use before applying changes, with machine-readable results for tooling.

Container Apps express deployments use the containerapp host and an image-based strategy. Express does not support multiple revisions or traffic splitting, so teams that depend on those rollout controls should not assume the express path meets their deployment requirements.

Generated pipelines and custom Go integrations need different checks

Generated GitHub Actions and Azure Pipelines definitions now install extensions required by extension-defined infrastructure providers. This addresses a dependency that generated pipelines need when infrastructure support comes from an extension rather than the core CLI.

Exported environment and state path Go APIs now return errors. Maintainers of custom implementations and mocks need to update them for the changed signatures, making compatibility testing part of the upgrade rather than only checking deployment behavior.

Azure DevOps brings an upgrade candidate and clarifies PHP patch ownership

Azure DevOps Server has a new release candidate for validation, while separate security guidance distinguishes the service itself from software running inside pipelines. Both items call for checking the components teams actually operate.

Azure DevOps Server 26H2 RC supports direct upgrade testing

Azure DevOps Server 26H2 RC is available to download, bringing features previously available in the hosted version alongside security and quality improvements. The release includes an updated Azure Boards interface, pull request target-branch dropdown improvements, better pipeline run debugging, and a new Test Run Hub.

Direct upgrades are supported from Team Foundation Server 2015 and newer, and an upgrade from this RC to the eventual RTW release will be supported. That gives administrators a supported path for evaluating the candidate without requiring a separate migration route to the final release. Team Foundation Server 2017 extended support ends on January 12, 2027, after which technical support will no longer be available.

PHP2Shell remediation belongs to the affected runtime

PHP disclosed two critical remote-code-execution vulnerabilities on October 21, 2026: CVE-2026-109618 and CVE-2026-109619. Neither Azure DevOps Services nor Azure DevOps Server uses PHP to handle customer requests, but that does not resolve exposure in PHP used by pipeline jobs, custom images, or deployed applications.

Fixed upstream releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, with vendor-confirmed backports also valid. Microsoft patches PHP preinstalled on hosted agent images, while customers remain responsible for PHP installed by pipeline steps or bundled in custom images. Upgrading an Azure Pipelines agent does not patch separately installed PHP, so remediation must include affected hosts, rebuilt containers, and verification of deployed runtimes.

Release integrity depends on credentials and reproducible artifacts

Two delivery practices address different parts of release integrity: replacing persistent publishing secrets and retaining the exact artifacts needed to diagnose production builds. Both require changes to release procedures, not just application code.

Marketplace Trusted Publishing replaces long-lived publishing tokens

Trusted Publishing supports publishing Visual Studio Code and Visual Studio extensions from GitHub Actions or Azure Pipelines without a long-lived personal access token (PAT). GitHub Actions uses a Marketplace policy and OpenID Connect (OIDC), receiving temporary credentials that expire after 15 minutes. Private-repository policies must complete a successful token exchange within 48 hours to become permanently active.

Azure Pipelines instead requires an Entra-backed Workload Identity Federation service connection and publisher Contributor access, with no Marketplace Trusted Publishing policy. Existing PAT-based publishing remains supported. Publishers should verify a successful federated publish before removing stored PATs, rather than deleting the working credential before validating its replacement.

Obfuscated .NET builds need traceable release artifacts

Randomized protection seeds can produce different protected binaries and rename maps from identical source code, complicating reproduction of production failures. Obfuscation modifies intermediate language (IL) and metadata, invalidating strong-name signatures applied before protection.

The guidance recommends archiving protected binaries and rename maps together as versioned release artifacts, with protection configuration source-controlled, reviewed through pull requests, and executed through continuous integration and delivery. Release checks should validate strong names, compare rebuilt outputs, and test protected assemblies rather than relying only on tests of the unprotected build.

Logic Apps adds local tooling and evidence for hybrid storage testing

Logic Apps coverage spans local workflow development and hybrid execution performance. The local CLI is a public preview, while the storage benchmark illustrates why throughput results need to be read alongside the underlying infrastructure limits.

A local CLI brings Standard workflows to the terminal

The Logic Apps Standard Azure CLI extension enters public preview with 59 extension-owned commands for local development and execution diagnostics. The logicapp 1.0.0b1 preview requires Azure CLI 2.67.0 or later and Python 3.10 or later. Its Outlook-to-Blob walkthrough runs workflows locally while keeping the mailbox, managed connection, and storage account in cloud services, so local execution does not mean a fully offline environment.

The azure-logic-apps-standard-cli skill on Awesome Copilot supplies connector discovery, validation, and approval procedures for GitHub Copilot. Local managed-connector wiring remains manual, and the current testing SDK/engine combination has a reported typed-output limitation. Developers should account for those constraints when evaluating the preview for automated testing.

SQL-backed hybrid benchmarks show a shared-storage constraint

Two 30-minute hybrid Logic Apps tests offered 1 KiB files at 100 files per second, with no failed workflow runs in either measured window. The repeat achieved 3.87% higher successful throughput, 6.40% lower p95 execution latency, and 8.68% lower p99 execution latency.

Those results came from a single host and backing disk shared by OpenShift, SMB files, SQL Server 2025 data and logs, and cluster virtual-machine storage. Average workflow-state data-file write latency rose from 12.958 to 38.652 milliseconds, while instance-wide accumulated lock waiting stayed near 1,470 task-seconds. Autoscaling allowed 1-10 workflow replicas on that same single-node infrastructure without adding disk capacity, limiting what the test can establish about scaling beyond the shared host.

Azure infrastructure choices hinge on authoring and resource lifecycle

The infrastructure-as-code comparisons separate two decisions: how to author Azure deployments and how removed or changed resources should be reconciled. Similar-looking declarations do not imply identical deployment behavior.

Bicep improves authoring without replacing Resource Manager

Bicep compiles into ARM template JSON, and both use Azure Resource Manager for deployment. Bicep adds type checking, symbolic resource references, reusable modules, and automatic dependency inference, while Microsoft continues to support ARM template JSON.

Both approaches work with Azure CLI, Azure PowerShell, GitHub Actions, and Azure Pipelines. Microsoft recommends Bicep for a better template authoring experience, and the Azure CLI what-if operation lets teams inspect anticipated infrastructure changes without applying them.

Terraform comparisons need deletion and state tests

Removing a resource declaration leaves the resource intact in standard incremental Bicep deployments, while Terraform normally proposes destroying resources still tracked in state. Deployment stacks can detach or delete removed resources according to actionOnUnmanage, but their stored what-if results are not executable Terraform-style saved plans. AzAPI provides access to ARM resource types and API versions while retaining Terraform's state and plan workflow.

The comparison recommends disposable pilots covering drift detection, reconciliation, declaration removal, and adoption of existing resources. Azure Verified Modules support both Bicep and Terraform, but their storage-account modules have different defaults and require careful version pinning. Teams should compare resulting resource behavior, not just the brevity of each configuration.

Server maintenance requires explicit restart and instance plans

Upcoming Windows security updates and a CycleCloud image-upgrade procedure both require planned downtime. Neither update path should be treated as a configuration-only change.

Windows Server 2022 hotpatch devices need consecutive restart windows

Hotpatch-enabled Windows Server 2022 devices will receive standard security updates requiring restarts in November and December 2026. A planned January 2027 baseline update also requires a restart, with the next hotpatch update expected in February 2027. Administrators should therefore plan maintenance around all three restart-requiring updates.

Affected devices remain enrolled in hotpatching without additional configuration. Windows Server 2025 and hotpatch-enabled Windows 11 devices retain their existing November and December schedules. Maintenance validation should check both successful update installation and completion of the required restart.

CycleCloud Slurm image upgrades can target selected instances

A validated CycleCloud procedure upgrades Ubuntu HPC image version 24.04.2026052601 to 24.04.2026092501 without recreating the entire Virtual Machine Scale Set. In Manual upgrade mode, changing the scale-set model does not update existing instances automatically. The procedure drains a Slurm node, updates the model, and applies it to a selected instance with az vmss update-instances.

Selected nodes experience downtime, and validation checks latestModelApplied, in-guest image metadata, operating-system health, Slurm registration, GPU drivers, RDMA, containers, and representative workloads. After validation, the CycleCloud node-array image configuration must be updated to prevent configuration drift.

Agent-assisted modernization still depends on engineering evidence

Two modernization reports show complementary responsibilities: preserving application-specific context during migration and validating generated changes at scale. Neither treats generated code as sufficient evidence that a migration is ready for production.

Intune migration combines agent work with engineer-owned context

The Intune team migrated an enrollment service from .NET Framework 4.7.2 to .NET 8 and moved its hosting to Azure Kubernetes Service. The first Windows enrollment library migration took one and a half weeks with GitHub Copilot modernization versus roughly six weeks manually, a 75% schedule reduction for that migration.

Engineer-owned plans, progress records, and context notes preserved dependency mappings and migration state across agent sessions. The agent mapped public and Microsoft-wide libraries well, but Intune-internal replacements required manually supplied context. Application-layer modernization is complete, while parity validation and the Azure Kubernetes Service traffic rollout continue.

Large-scale rewrites pair agents with tests and formal checks

Microsoft describes combining AI agents with static analysis, testing, and formal verification for large-scale transformation since 2024. Examples include adding Clang/LLVM toolchain support across the Windows codebase and remediating CodeQL, PREfast, and Roslyn analyzer findings. Experts approve agent-generated knowledge bases rather than each individual fix, reserving human review for novel or ambiguous cases.

For C/C++ modernization into Rust, validation includes differential testing, held-out tests, and Verus proofs. Agents infer TLA+ specifications, while TLC checks implementation traces, and Microsoft is building compilers that translate TLA+ into F* and Lean. The practical lesson is to design verification alongside the transformation process, rather than use review alone as the final filter.

Fabric adds operational visibility and deployment configuration controls

Fabric updates cover query investigation, reusable Eventstream configuration, and gateway administration. Several capabilities remain in preview, with workspace access and deployment prerequisites still requiring administrator attention.

Warehouse monitoring and database agents support investigation

Workspace monitoring integration for Fabric Data Warehouse is in preview for warehouses, SQL analytics endpoints, and warehouse snapshots. Enabling it creates a read-only monitoring Eventhouse and KQL database scoped to the workspace. WarehouseExecutions records completed, user-initiated distributed queries, including duration, CPU time, status, result codes, and identity data.

Its OperationId matches Query Insights distributed_statement_id, allowing exact lookup of corresponding query records. Administrators can save KQL queries or build Real-Time Dashboards for performance percentiles, CPU usage, and recurring failures.

A separate Database Agents demonstration covers blocking, query performance problems, resource pressure, and plan regressions through Database Hub and SQL Server Management Studio integration. Patrick LeBlanc walks through configuration and issue detection, while agents learning from database-administrator interactions are described as a long-term vision.

Eventstream variable libraries preserve symbolic references

Eventstream variable library integration is available in preview for supported source connections and destination items. Connection-reference and item-reference variables point to managed Fabric resources rather than storing credentials or raw connection strings. Those symbolic references survive Git integration and deployment pipelines.

Only one variable library value set is active at a time, and Eventstream resolves references against that set. Before deployment and publishing, target workspaces need accessible resources and correctly configured variable libraries. The reusable definition therefore still depends on valid environment-specific configuration.

Gateway release improves diagnostics and previews connection APIs

On-premises data gateway version 3000.338 includes Power Query Engine 2.159.229 and compatibility with the October 2026 Power BI Desktop release. Connection tests now preserve Power Query configuration settings, and gateway service-start failures provide more detailed diagnostics.

Preview Admin Connections REST APIs let Fabric administrators and service principals manage tenant-wide on-premises gateway, virtual network gateway, and cloud connections. Microsoft recommends non-production validation followed by production upgrades one cluster member at a time. Only the last six gateway releases are supported, making regular upgrade testing part of ongoing maintenance.

Visual Studio improves change review and session recovery

Visual Studio's October update addresses reviewing changes, resolving conflicts, and retaining work between sessions. Some editor capabilities are opt-in rather than enabled by default.

Compare working changes and resolve conflicts in bulk

Visual Studio 2026 Stable Channel can compare historical commits with the current working tree, including edits still in progress. Git Changes adds Keep All Current and Take All Incoming for multiple conflicted files, folders, or the repository root. These controls support reviewing the current state against history and applying a consistent conflict choice to a selected scope.

Chat and settings receive updated infrastructure

An opt-in Copilot Chat experience extends the Copilot SDK foundation to Ask mode, Agent mode, and the underlying chat infrastructure. The refreshed Fonts and Colors page uses Unified Settings, adds search and inline previews, and synchronizes changes with settings.json.

Hot Exit preserves investigations but does not replace saving

Visual Studio 2026 version 18.11 supports creating standalone Markdown files through New File without adding a project item. Hot Exit, an opt-in preview disabled by default, restores open documents and unsaved edits, including new files that have never been saved.

It preserves tab and window layouts and undo functionality for previously saved files. This can help retain investigation notes between sessions, but it does not replace saving documents to disk or committing them to source control.

PostgreSQL workflows stay in VS Code, with verification still required

The PostgreSQL material follows a connected workflow from database access and schema exploration to query authoring and performance investigation. Copilot uses database context, but generated SQL and proposed optimizations still need validation against the database.

Connect and understand an unfamiliar database

Microsoft's PostgreSQL extension for VS Code supports saved connection profiles and exploration of schemas, tables, views, functions, sequences, and extensions. The Azure connection walkthrough uses Microsoft Entra ID, while Object Explorer and relationship visualization help developers inspect unfamiliar database structures.

Copilot Chat can answer context-aware questions during exploration. The demonstrations verify findings against the database itself, making the assistant a guide to investigation rather than a substitute for checking the underlying objects.

Author SQL and inspect results in the editor

The extension provides SQL authoring with IntelliSense and database context, while Copilot helps draft, explain, analyze, and improve queries. Developers can run queries, inspect results, and export data within VS Code, keeping the authoring and validation steps in the same workspace.

Investigate performance through controlled changes

The performance walkthrough starts with the Performance Dashboard, identifies workloads and queries, reviews Azure Advisor guidance, takes a controlled action, and verifies the result. Database Agent brings issue context and recommended actions together while retaining user review and approval.

The broader extension guide recommends verifying generated SQL and comparing original and revised query results before accepting performance changes. Its accompanying video presents Database Agent as upcoming and describes automated remediation as a future capability, so that discussion should not be read as a general-availability announcement.

Other DevOps News

A runtime and automation roundup reports that .NET 11 is feature complete enough for serious production validation, while Python 3.15 now defaults to the native Arm64 runtime on Windows on ARM. Browser automation in Microsoft Foundry is generally available, distinct from the validation guidance for .NET 11.

Microsoft Graph v1.0 channel-creation requests that omit layoutType will default to Threads instead of Posts, with rollout expected to begin and finish in late November 2026 across commercial, GCC, GCC High, and DoD environments. Existing Teams channels retain their layouts, but provisioning code should set "post" to preserve Posts or "chat" to select Threads explicitly.

GitHub added webhook delivery ranges 9.234.98.160/28, 9.234.98.176/28, and 9.234.106.48/28 to the Meta API's hooks field. Static allowlists should add them alongside existing ranges, while allowlists maintained through the Meta API need no changes for these additions.

A tested 64 GB laptop held Qwen3.8-27B, its draft model, and the full 262,144-token context, with a final full-context profile of 44.1 tokens per second. Separate 70-minute agent runs completed 111 requests at one-request concurrency versus 74 at two, while OpenTelemetry exported metrics to Azure Monitor managed service for Prometheus and traces to Application Insights using Microsoft Entra ID authentication.

VS Code 1.145 Insiders adds progress tracking, retained results, and retries for bulk worktree cleanup in the Agents window, alongside experimental integrated-browser previews for apps on remote agent hosts. The evolving release notes include a keyboard accessibility fix for authentication prompts in screen reader mode and symbol breadcrumbs for unsaved files when supported by the language.

The Universe closing keynote and podcast discuss AI's impact on open source, collaborative planning, and maintainer boundaries, including low-effort AI contributions and pull request limits. Their hackable badge coverage is complemented by Pimoroni's manufacturing walkthrough, which shows stencil printing, pick-and-place assembly, solder reflow, and custom firmware developed with Copilot.

Arnis uses OpenStreetMap data to turn geographic coordinates into playable Minecraft worlds, with a repository that attracted geospatial specialists and contributors worldwide. Sole maintainer Louis Erbkamm uses the GitHub Copilot app to triage bug reports and review pull requests.

A short from GitHub Universe tests attendees on repository forks, git blame, and blob objects. Another short highlights a VS Code Done interaction with confetti.

Also relevant this week

Dates to know

Deadlines