AI 開發工具
GitHub Agentic Workflows Adds Real-Time PR Steering, but v0.87.4 Cited in the Official Weekly Report Does Not Include It
The new feature lets a running agent read PR comments and adjust its work based on `steer` instructions, while requiring explicit read permissions. However, the official weekly report recommends trying it with the earlier v0.87.4 release; deployments pinned to that tag will not actually get the feature.
GitHub Agentic Workflows (`gh-aw`) merged PR steering on August 24. After a workflow sets `safe-outputs.create-pull-request.steer: true`, the system first creates a PR, allowing the still-running agent to search for user-submitted PR comments or review comments containing the `steer` keyword and incorporate that feedback into its subsequent work. This turns an Actions job that previously required users to wait for the agent to finish into one that can be corrected mid-run through the existing review interface.
The permission boundary is designed relatively clearly. The workflow must explicitly declare `pull-requests: read`; if the compiler cannot resolve a valid permission, it raises an error instead of automatically escalating privileges. If the GitHub MCP uses a tool allowlist, the compiled output adds only `pull_request_read`. The PR itself indicates that steering is enabled, so commenters know their messages may become model input.
However, the release information contains a version mismatch that deployers should note. The August 24 weekly report lists steering as a highlight of the v0.87.4 series and instructs readers to download v0.87.4 to try it. GitHub’s immutable release page, however, shows that this pre-release was created on August 22. The steering PR was not merged until August 24 and modified 11 commits, so a build pinned to v0.87.4 cannot include the feature. What v0.87.4 actually added includes stricter safe-output compilation validation, support for pinning Agent Plugins, per-engine model overrides, and a change preventing `GH_TOKEN` from being left in a clone’s `.git/config`.
Engineering teams should not update their configurations solely by following the weekly report’s example. They should first verify that the commit or a later tag they use actually includes PR #55171. Another security concern is that steering formally connects collaborator comments to the prompt path. Even though it does not expand GitHub permissions, it may become an entry point for prompt injection or scope drift. Future versions need to define clearly which identities may steer, how comments are ordered and deduplicated, and how conflicting instructions are handled after the agent has already performed steps with side effects.