To build a debuggable GitHub Copilot incident-response workflow, put deterministic evidence collection and handoffs around bounded agent analysis: gather authorized logs and telemetry, assign separate investigations, require structured findings, then combine them into a timeline and root-cause report. Make each phase visible and keep a human able to inspect, pause, or resume the run. GitHub documents this as a service-interruption example, not as proof of production deployment or independently measured incident outcomes.
What a dynamic workflow does
GitHub describes a dynamic workflow as “a program that defines how a task is carried out.” In practice, it is code-defined orchestration for a repeatable task: steps can run sequentially, in parallel, or in a mixture. The author specifies the process, conditions, handoffs, and how results flow; agents handle work that calls for analysis or judgment. GitHub Docs: Dynamic workflows
As an Amazon Associate I earn from qualifying purchases.
That distinction is useful during an incident. The workflow can make evidence-gathering and report assembly predictable without pretending that an agent’s interpretation of logs or telemetry is deterministic.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Design the incident workflow as inspectable stages
GitHub’s documented service-interruption example collects logs and telemetry, assigns agents to analyze different systems, and combines structured findings into a timeline and root-cause report. The stage boundaries below turn that example into a practical starting design; they are implementation advice, not a GitHub-mandated incident procedure.
#1 Best Overall
- Collect authorized evidence. Gather relevant service logs and telemetry using the tools and access the run is permitted to use. Keep the initial scope narrow enough to understand what data entered the workflow.
- Dispatch bounded investigations. Assign distinct systems or evidence sets to separate analysis tasks. Give each task a clear question and boundary so that findings can be traced to the part of the incident it examined.
- Require structured results. Specify the fields each analysis must return, such as system or evidence set, time range, observations, and uncertainties. Use one stable format across tasks so the next stage can consume results consistently.
- Consolidate the findings. Have a final stage use the collected results to assemble a time-ordered incident timeline and root-cause report. Keep observations distinct from interpretations rather than turning an agent’s inference into established fact.
- Expose checkpoints and controls. Report meaningful phase changes, set appropriate resource limits, and leave room for a human to inspect progress and decide whether to continue.
Make runs easier to debug
Debuggability depends on being able to tell what the workflow is doing, what evidence each stage received, and where a result came from. Name phases clearly and make each handoff explicit. Stable output formats help distinguish a failure to gather evidence from an analysis that returned an unexpected result.
- Monitor active subagents and AI-credit use in the run UI or CLI.
- With OpenTelemetry configured, inspect the
invoke_workflowspan created for each run or resume and its linked agent activity. - Set workflow limits while validating a new workflow. Limits are optional, but GitHub recommends them to control AI-credit use.
- If a run reaches a configured limit, it can be paused or stopped; eligible runs may be resumed after increasing the limit.
These controls provide visibility into execution, not a guarantee that a generated root-cause conclusion is correct. Preserve the underlying evidence and have an incident owner assess consequential conclusions.
Use custom agents and hooks for different jobs
Custom agents define bounded roles
Custom agents let you specialize prompts, available tools, and MCP servers for a particular analysis role. In the Copilot SDK, custom sub-agents run in isolated contexts and stream lifecycle events to the parent session, which integrates their results. This can help keep system-specific investigations separate while retaining a coordinated final response. About custom agents and Custom agents and sub-agent orchestration
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Hooks run commands at execution points
Hooks are complementary: they run shell commands at chosen points around sessions, prompts, tool use, and errors. Use them for relevant diagnostics or automated checks rather than for the agent’s interpretive work. For Copilot coding agent, hook configuration must be present on the repository’s default branch. Customize agent workflows with hooks
Choose an execution surface and prepare permissions
Dynamic workflows are documented for the Copilot app, CLI, and SDK, subject to GitHub’s plan eligibility terms. The appropriate surface depends on whether the work is interactive, command-line driven, or integrated into an application.
| Surface | Useful distinction | Setup or monitoring detail |
|---|---|---|
| Copilot app | Interactive workflow authoring and runs | Run monitoring is documented for local sessions. |
| Copilot CLI | Command-line invocation | Enable experimental features with --experimental or /experimental on. Programmatic invocation does not show permission-approval prompts, so provide required tool and URL permissions before starting. |
| SDK | Workflow use in an application or programmatic integration | Review the current SDK guidance and provide the permissions and configuration required by the workflow. |
The feature is in public preview and may change. Check GitHub’s current documentation for plan eligibility, billing details, and feature behavior before relying on them. Interactive workflow creation may request approval; do not assume a programmatic CLI run will prompt for missing permissions. Using dynamic workflows
Rank #4
Decide how the workflow should be reused
A workflow created in a session is session-local by default. To reuse or share it, place the extension in personal or project extensions. A project workflow becomes available to teammates after the repository change is shared and their extension state is reloaded. This separates a useful prototype from a workflow that others can reliably access.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsHow workflows differ from autopilot and fleet
| Approach | Who defines the next steps? | Best fit |
|---|---|---|
| Dynamic workflow | The author defines reusable steps and handoffs; the exact path can still vary with inputs and findings. | A repeatable incident investigation with inspectable stages. |
| Autopilot | The system focuses on autonomous continuation and decides the next steps. | Work where autonomous continuation is the priority rather than an authored process. |
| Fleet | Copilot decides how to divide and coordinate delegated work on each run. | Delegation where the system should determine the work split for each run. |
Start small and verify the handoffs
For a first incident workflow, choose one service and a limited evidence set. Check that collection returns the intended material, each analysis produces the specified structure, and the final stage can build a timeline from those outputs. Expand systems or evidence sources only after these boundaries are understandable in a run. Treat the resulting report as an aid to investigation, not as independent confirmation of cause.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
