Research

What the numbers say.

Who actually runs coding agents from GitHub Actions, what each agent supports, and whether skills help. Every number links to its source. Last checked Oct 17, 2026.

repos run agents from YAML: ~11k; repos run agents from YAML
pts from curated skills: +16.6; pts from curated skills
skills beat big bundles: ≤3; skills beat big bundles

Adoption

YAML-driven agents are real, and still early.

~11k

public repos run a coding agent from workflow YAML

Lower bound, arXiv 2605.07135

~2.2M

agent-written PRs in one week, mostly from laptops

Week ending 2026-10-11, amplifying.ai

The only direct count we found searched public .github/workflows files for agent actions and found 13,392 workflows in 10,792 repos. Lower bounds from GitHub code search. The paper does not give its collection date, and Cursor and gh-aw are not counted.

Workflows per action

anthropics/claude-code-action5,212
actions/ai-inference795
openai/codex-action492
testdriverai/action300
google-gha/run-gemini-cli244
anthropics/claude-code-base-action227
austenstone/copilot-cli195

Source: Demystifying and Detecting Agentic Workflow Injection Vulnerabilities in GitHub Actions (arXiv 2605.07135, May 2026)

Copilot is an exact bot-account count. The others are estimated from declared attribution and include local runs, not only CI.

Support

Which agent does what.

I need:

Count "write it yourself" as supported

Pick what you need to see which agents fit.

Capability	claude-code-action	codex-action	Cursor	gh-aw	Copilot agent
Runs from your workflow YAMLCan you add it as a step in your own .github/workflows file?	Built inuses: anthropics/claude-code-action	Built inuses: openai/codex-action	Built inInstall the CLI or curl the Cloud Agents API	Built inMarkdown source compiles to a .lock.yml workflow	Not supportedGitHub runs it for you; there is no uses: step
@mention in a commentSomeone types @agent in an issue or PR and the agent answers.	Built intrigger_phrase, default @claude	Write it yourselfWrite the if: contains(...) check yourself	Write it yourselfWrite the trigger yourself	Built inslash_command	Built inComment-triggered automations (Aug 2026)
Label triggerAdding a label such as ai-review starts the agent.	Built inlabel_trigger	Write it yourselfon: issues labeled + an if: check	Write it yourselfon: issues labeled + an if: check	Built inlabel_command, removes the label after	Not supportedNot documented
Assign an issueAssigning the issue to the agent hands it the work.	Built inassignee_trigger	Write it yourselfon: issues assigned	Write it yourselfon: issues assigned	Write it yourselfon: issues assigned	Built inThe main way to start it
ScheduleRuns on a timer, for example a nightly maintenance pass.	Built incron + automation mode	Write it yourselfcron	Write it yourselfcron	Built inFuzzy schedules such as "daily"	Not supportedNot documented
Fix failing CIWakes up when another workflow fails and tries a fix.	Write it yourselfworkflow_run + actions: read	Write it yourselfworkflow_run	Built inCookbook has a fix-CI example	Built inSee the CI coach workflow	Not supportedNot documented
Structured outputThe agent returns JSON that matches a schema, so later steps can use it safely.	Built in--json-schema	Built inoutput-schema	PartialJSON output, no schema enforcement	Built inTyped safe-outputs	Not supportedNot applicable
MCP toolsThe agent can call Model Context Protocol servers during the run.	Built in--mcp-config; GitHub MCP built in	PartialConfigure through codex-home	Built inmcpServers in the API	Built intools: and imports:	Built inRepository MCP settings
Pay with a subscriptionUse a plan you already pay for instead of a metered API key.	Built inCLAUDE_CODE_OAUTH_TOKEN (Pro, Max, Team, Enterprise)	Not supportedOpenAI API key or Azure only	Built inBilled to your Cursor plan usage	PartialCopilot engine yes; ignores CLAUDE_CODE_OAUTH_TOKEN	Built inCopilot seat, AI Credits since June 2026

Checked against vendor docs on Oct 17, 2026: Claude Code GitHub Actions docs · openai/codex-action README · Cursor CLI in GitHub Actions · gh-aw frontmatter reference · gh-aw auth reference · About Copilot coding agent · Copilot automations from comments

Skills

Do skills actually make agents better?

+16.6 pts
Curated skills help on average
Across 87 tasks and 18 model setups, human-written skills raised pass rates from 33.9% to 50.5%. Software engineering gained less: +11.6 points.
SkillsBench, arXiv 2602.12670
−8 to −11.5
Self-written skills hurt
Skills an agent wrote for itself scored below having no skill at all. Write or curate them by hand.
SkillsBench, arXiv 2602.12670
≤3 modules
Focused beats exhaustive
Small skills beat big bundles. Skills that forced one rigid pipeline made results worse on 13 of 87 tasks.
SkillsBench, arXiv 2602.12670
+20% cost
AGENTS.md rarely lifts success
Context files generally did not raise task success and added over 20% inference cost. They helped most for unusual conventions.
Evaluating AGENTS.md, arXiv 2602.11988
−29% time
But it can make runs faster
A second study saw median runtime drop about 29% and output tokens about 17%, with similar completion.
AGENTS.md efficiency, arXiv 2601.20404

How we rate each skill

Research-backedPublished studies support the core practice.
Practitioner-backedIndustry practice and surveys support it; controlled studies are thin or mixed.
OpinionPlausible craft advice that nobody has measured.

Skill	Rating	Why
Code review	Practitioner-backed	Code review itself is well studied: low review coverage predicts more post-release defects. The checklist format this skill uses is not; a 2022 study found no strong link between checklists and review performance. LLM reviewers still miss most issues (best F1 about 19% on SWR-Bench), and structured prompts help mainly by cutting false positives.
Debug	Research-backed	Observed professionals reproduce, build a model, fix, and validate, and they lean on recent changes, which is the loop this skill teaches. Offering developers candidate hypotheses made them 6x more likely to succeed. The agent-side gain is unproven: LLM "scientific debugging" did not consistently beat plain repair.
Deploy checklist	Practitioner-backed	DORA research supports the canary, monitoring, and rollback parts. It also finds heavyweight external change approval adds no stability benefit, which cuts against this skill's approvals items. Nothing measures agents writing deploy checklists.
Documentation	Practitioner-backed	DORA links documentation quality to organizational performance, and 93% of open-source contributors call outdated docs a pervasive problem. The templates themselves are convention, and nothing measures a docs skill for agents.
Frontend design	Opinion	Well-crafted taste from the vendor, but untested: the published write-up shows before-and-after screenshots with no metrics or blind comparison. Critique-then-revise loops have some support when they get real feedback such as screenshots.
System design	Practitioner-backed	The requirements-first framework mirrors textbook practice. Clarifying ambiguous requirements before coding raised GPT-4 pass rates from 68.0% to 75.8% in one study, though that measured code generation, not design.
Testing strategy	Practitioner-backed	The testing pyramid's proportions are convention: one study found unit and integration tests catch the same defect types. Handing an LLM the tests up front does raise its pass rates, which supports test-first agent loops.
Web app testing	Practitioner-backed	Running bundled scripts instead of loading them into context is a reasonable design argument without a published evaluation. Focused skills like this one beat exhaustive bundles on SkillsBench. One instruction contradicts Playwright's own docs (see the caveat).
Browser testing with Chrome DevTools MCP	Evidence not reviewed	Not reviewed yet.
CI/CD and automation: set up build and deploy pipelines	Evidence not reviewed	Not reviewed yet.
Multi-axis code review before merge	Evidence not reviewed	Not reviewed yet.
Constraint-driven development: stop agents quietly lowering the quality bar	Evidence not reviewed	Not reviewed yet.
Context engineering: set up agent context for quality output	Evidence not reviewed	Not reviewed yet.
Debugging and error recovery: systematic root cause	Evidence not reviewed	Not reviewed yet.
Doubt-driven development: fresh-context adversarial review of decisions	Evidence not reviewed	Not reviewed yet.
Git workflow and versioning: commits, branches, releases	Evidence not reviewed	Not reviewed yet.
Incremental implementation: thin, verifiable slices	Evidence not reviewed	Not reviewed yet.
Planning and task breakdown: spec to ordered tasks	Evidence not reviewed	Not reviewed yet.
Security and hardening: audit inputs, auth and secrets	Evidence not reviewed	Not reviewed yet.
Source-driven development: ground decisions in official docs	Evidence not reviewed	Not reviewed yet.
Spec-driven development: write the spec before code	Evidence not reviewed	Not reviewed yet.
Test-driven development: red-green-refactor loop	Evidence not reviewed	Not reviewed yet.
Agent harness construction: action spaces, tools, observations	Evidence not reviewed	Not reviewed yet.
Agentic engineering: eval-first, decomposed, cost-aware execution	Evidence not reviewed	Not reviewed yet.
AI regression testing for agent-written code	Evidence not reviewed	Not reviewed yet.
Autonomous loops: patterns for unattended Claude Code pipelines	Evidence not reviewed	Not reviewed yet.
Context budget: check live context use in Codex or Claude Code	Evidence not reviewed	Not reviewed yet.
Android skills: the android-cli entry skill from the official Android pack	Evidence not reviewed	Not reviewed yet.
Subagent development: create and tune Claude Code subagents	Evidence not reviewed	Not reviewed yet.
Build an MCP server: end-to-end server scaffolding guide	Evidence not reviewed	Not reviewed yet.
Claude API reference: models, params, streaming, tool use	Evidence not reviewed	Not reviewed yet.
Claude Code automation recommender: suggests hooks, subagents, skills, MCP	Evidence not reviewed	Not reviewed yet.
CLAUDE.md improver: audit and tighten your CLAUDE.md	Evidence not reviewed	Not reviewed yet.
Slash command development: build custom commands	Evidence not reviewed	Not reviewed yet.
Hook development: write PreToolUse/PostToolUse/Stop hooks	Evidence not reviewed	Not reviewed yet.
MCP builder: guide to building high-quality MCP servers	Evidence not reviewed	Not reviewed yet.
MCP integration: add and configure MCP servers in a plugin	Evidence not reviewed	Not reviewed yet.
Session report: HTML report of tokens, cache, subagents and skills usage	Evidence not reviewed	Not reviewed yet.
Skill creator: write, improve and eval new skills	Evidence not reviewed	Not reviewed yet.
Skill development: author skills for Claude Code plugins	Evidence not reviewed	Not reviewed yet.
Hookify rules: write guardrail rules without hook code	Evidence not reviewed	Not reviewed yet.
Caveman: short-output skill that cuts agent tokens	Evidence not reviewed	Not reviewed yet.
Cloudflare Agents SDK: build, debug and review agents apps	Evidence not reviewed	Not reviewed yet.
Cloudflare Durable Objects: stateful coordination code	Evidence not reviewed	Not reviewed yet.
Web performance audit: Core Web Vitals and Lighthouse	Evidence not reviewed	Not reviewed yet.
Cloudflare Workers best practices for production	Evidence not reviewed	Not reviewed yet.
Wrangler: run and troubleshoot Cloudflare Wrangler CLI	Evidence not reviewed	Not reviewed yet.
EAS workflows: write Expo CI/CD workflow YAML	Evidence not reviewed	Not reviewed yet.
Expo SDK upgrade and dependency fixes	Evidence not reviewed	Not reviewed yet.
Claude settings audit: recommend settings.json permissions	Evidence not reviewed	Not reviewed yet.
Commit: conventional commit messages (Sentry style)	Evidence not reviewed	Not reviewed yet.
Find bugs: bugs, vulns and quality issues in branch changes	Evidence not reviewed	Not reviewed yet.
GitHub Actions security review: find workflow exploitation bugs	Evidence not reviewed	Not reviewed yet.
Iterate on a PR until CI passes and review feedback is addressed	Evidence not reviewed	Not reviewed yet.
PR writer: reviewer-facing PR titles and descriptions	Evidence not reviewed	Not reviewed yet.
Skill scanner: scan agent skills for security issues	Evidence not reviewed	Not reviewed yet.
Skill writer: create and improve skills per the Agent Skills spec	Evidence not reviewed	Not reviewed yet.
gh-aw agentic workflows: design, create, debug and upgrade	Evidence not reviewed	Not reviewed yet.
Checkout credential review: safe git/gh ops in agentic workflows	Evidence not reviewed	Not reviewed yet.
Debug gh-aw workflow failures from logs and audits	Evidence not reviewed	Not reviewed yet.
Optimize agentic workflow token usage (gh-aw)	Evidence not reviewed	Not reviewed yet.
Review agentic workflow changes for correctness and security	Evidence not reviewed	Not reviewed yet.
gstack: Garry Tan's Claude Code skill set	Evidence not reviewed	Not reviewed yet.
Hugging Face Hub CLI: models, datasets and Spaces	Evidence not reviewed	Not reviewed yet.
Hugging Face model evals with inspect-ai and lighteval	Evidence not reviewed	Not reviewed yet.
Code review (Matt Pocock): review changes since a fixed point on two axes	Evidence not reviewed	Not reviewed yet.
Diagnosing bugs: loop for hard bugs and perf regressions	Evidence not reviewed	Not reviewed yet.
Grill with docs: interview to sharpen a plan and write ADRs	Evidence not reviewed	Not reviewed yet.
Improve codebase architecture: find deep-module opportunities	Evidence not reviewed	Not reviewed yet.
PR body writer (Matt Pocock)	Evidence not reviewed	Not reviewed yet.
TDD (Matt Pocock): build features and fix bugs test-first	Evidence not reviewed	Not reviewed yet.
To tickets: turn a plan into tracer-bullet tickets	Evidence not reviewed	Not reviewed yet.
Triage: move issues and PRs through a triage state machine	Evidence not reviewed	Not reviewed yet.
Wayfinder: plan work bigger than one agent session	Evidence not reviewed	Not reviewed yet.
Superpowers: plan, test, and review skills framework	Evidence not reviewed	Not reviewed yet.
Playwright skill: browser-test your app from the agent	Evidence not reviewed	Not reviewed yet.
pstack for Claude Code, Codex, and more	Evidence not reviewed	Not reviewed yet.
Stripe integration best practices	Evidence not reviewed	Not reviewed yet.
Upgrade Stripe API versions, SDKs and webhooks	Evidence not reviewed	Not reviewed yet.
Supabase: database, auth, storage and edge functions tasks	Evidence not reviewed	Not reviewed yet.
Postgres best practices (Supabase)	Evidence not reviewed	Not reviewed yet.
SVG diagram skill for architecture and flow charts	Evidence not reviewed	Not reviewed yet.
React composition patterns that scale (Vercel)	Evidence not reviewed	Not reviewed yet.
React and Next.js performance best practices (Vercel)	Evidence not reviewed	Not reviewed yet.