Complete GitHub Copilot Code Review Guide (2026)

GitHub Copilot code review is an automated reviewer built into GitHub and supported editors. It reads pull requests or local edits, posts findings, suggests fixes, and can hand work to Copilot cloud agent. Teams can request it by hand or apply it through GitHub rulesets.

The product has moved beyond its early diff-only form. Current review can gather full project context, run setup steps, use repository instructions, work behind a configurable firewall, and spend GitHub Actions minutes as well as AI Credits.

Copilot is worth trying first if your team already uses GitHub and a paid Copilot plan. It will not suit every repository. Our own team removed mandatory Copilot reviews after finding them too noisy. Compare other AI code review tools if the same problem persists for you.

Copilot Code Review at a Glance

Some Copilot review features are still in public preview and may change.

Area	Current Position	Team Check
Review result	Comment by default; approvals in preview	Who owns bot approvals
Manual trigger	Request Copilot reviewer	Under 30 seconds typical
Automatic trigger	GitHub ruleset	Review-on-push noise
Context	Full project gathering	Runner path works
Review effort	Lite or Balanced	Balanced costs more
Usage cost	AI Credits and Actions	Budgets set first

What Can GitHub Copilot Code Review Do?

GitHub Copilot code review checks proposed changes for potential bugs and improvements, then posts comments and suggested fixes. GitHub says it supports code in any language. It examines a pull request from several angles, leaves inline findings, and often attaches a suggested edit. A developer can apply one suggestion, group suggestions into a commit, or ask Copilot cloud agent to prepare a fix.

The feature appears on GitHub.com, GitHub Mobile, GitHub CLI, VS Code, Visual Studio, Xcode, and JetBrains editors. Azure DevOps is in public preview. An organisation may need to enable the code review policy before members can use it.

GitHub also lets eligible organisation members without a Copilot licence request review on GitHub.com. An admin must allow paid AI Credit use and turn on the unlicensed-member policy. Those reviews can become direct organisation usage instead of drawing from a personal allowance.

Copilot code review remains an adviser in the merge flow by default. GitHub tells teams to validate its feedback and add human review. A September 2026 preview lets admins allow Copilot approvals, so write down when those approvals may count and enforce that policy through branch rules.

How Do You Request a Copilot Code Review?

Request a GitHub Copilot code review by opening the pull request’s Reviewers menu and selecting Copilot. GitHub says the review usually returns in under 30 seconds. By default it appears as a Comment review with inline items that developers can reply to, resolve, hide, or rate.

Replies remain visible to people, yet Copilot does not read or answer them in that thread. Use the reaction controls to send product feedback. Keep technical debate in the pull request where the human reviewers can resolve it.

Automation can request the reviewer through GitHub’s REST API using copilot-pull-request-reviewer[bot]. The REST API request is the documented mechanism; there is no magic comment form of it, so do not expect a comment like @copilot review to do the same job. Test the request on a sandbox repository before adding it to a workflow.

Request reviews manually for the first month so you can track their cost and usefulness. Ask for Copilot on a mix of normal work, known-bug examples, and PRs where repository context should matter. Record findings before enabling an organisation-wide rule.

Can Copilot Review Code Before You Open a Pull Request?

Copilot can review local edits before they become a pull request. In VS Code, a developer can run review against uncommitted changes and see findings inline or in the Problems panel. Applied suggestions alter the working tree and are not committed automatically.

This pre-push pass serves a different purpose from shared review. It helps an author catch a local mistake before asking teammates, while the GitHub review creates a record on the pull request. Teams can use both without treating either as approval.

GitHub also lists review in Visual Studio, Xcode, JetBrains editors, GitHub CLI, and GitHub Mobile. Availability and controls differ by interface, so use the matching official tab when documenting a team workflow. The Free plan includes neither pull request reviews nor file diff reviews in editors, according to GitHub's plan comparison.

Azure DevOps review is in public preview, which means rollout details can move. Test repository policy, billing attribution, comments, and runner behaviour in Azure DevOps before treating it like the GitHub.com path.

How Much Does GitHub Copilot Code Review Cost?

GitHub Copilot code review consumes AI Credits on eligible plans, with Actions usage added for agentic work. Paid individual plans start at $10 per month; organisation billing and allowances depend on the plan and policy. The subscription price is not an unlimited-review price.

Plan	Price	Review	Buyer
Free	$0	Not included	Individual trial
Pro	$10/user/mo	Included with credits	Individual developer
Pro+	$39/user/mo	Included with credits	Higher individual use
Max	$100/user/mo	Included with credits	Highest individual allowance
Business	$19/user/mo	Policy and budgets	Organisations
Enterprise	$39/user/mo	Enterprise controls	Large organisations

The listed plan price only forms the base. Each pull-request or editor review consumes AI Credits based on the model and tokens processed. Full project context and other agentic functions also use GitHub Actions runner minutes.

GitHub's billing guide says each plan has a monthly AI Credit allowance. Paid extra use, budgets, and existing annual terms can alter the bill. Check the account's live billing page before forecasting automatic review.

Cost per useful finding is a better measure than reviews per month. Divide AI Credit and runner spend by comments that led to a verified fix. Include the time spent dismissing repeats and checking generated edits.

How Do You Enable Automatic Copilot Reviews?

Enable automatic Copilot review through a repository or organisation ruleset that targets the pull requests you want reviewed. The automatic review guide also offers review on draft pull requests and each new push.

Enable review for open pull requests on a few repositories first. Draft review can send feedback while code is still moving, and review on every push can repeat work. GitHub’s enterprise guidance warns that the extra triggers can create more noise.

Rulesets can target branches and repository name patterns. Organisation owners can apply one policy across selected repositories, while repository owners can define a local rule. Exclusions apply after inclusion patterns, so check the final target set before activation.

Who pays depends on how the review starts. For an automatic review, GitHub attributes AI Credits to the pull-request author; a manual request by another person attributes usage to that requester.

Copilot cloud-agent pull requests are billed first to the human co-author, falling back to the organisation. Reviews of other bot-authored pull requests, or reviews requested by other bots, are billed directly to the organisation. Administrators can also choose organisation billing for licensed members.

An exhausted budget can block later review runs. On Business and Enterprise plans, user, enterprise, or cost-centre limits govern code-review access. Test the blocked state so authors know whether a missing review means clean code, exhausted budget, or a failed runner.

How Do Copilot’s Lite and Balanced Reviews Differ?

Copilot’s Lite review favours faster, lower-cost feedback, while Balanced uses more reasoning for complex changes and is the built-in default. Both can use GitHub Actions runners to gather project context. GitHub says this makes reviews more specific because the service can inspect the repository around the pull request, including code beyond the touched lines.

The context path depends on runner availability. If GitHub Actions is unavailable or a review workflow fails, Copilot still produces a review with fewer agentic functions. Larger hosted runners cost more per minute, while self-hosted runners avoid GitHub Actions minute charges but leave runtime operation with the team.

GitHub estimates $0.05 to $1 in AI Credits for a Lite review and $0.25 to $5 for Balanced, before applicable Actions usage. These are estimates, not fixed per-review charges.

Balanced can consume more AI Credits and Actions minutes. Use it on repositories where a missed contract or security bug costs enough to warrant that spend. Routine documentation or small local edits can remain on Lite.

Test repository context with a controlled contract break. Rename an exported function without editing one caller, alter a shared schema, or remove an authorisation check used by another package. A valid finding should name the related path and explain the contract.

How Do You Customise Copilot Code Review?

Customise Copilot code review with repository instructions, path-specific rules and, where needed, review setup steps or external context tools. GitHub currently names .github/copilot-instructions.md, path-scoped *.instructions.md files, AGENTS.md, agent skills, REVIEW.md, GEMINI.md, and CLAUDE.md.

A July 17, 2026 update moved review instructions to the pull request's head branch. That lets a team test a new rule before merging it. Treat instruction edits as code because an untrusted branch can alter the reviewer's guidance.

Review-specific setup uses .github/workflows/copilot-code-review.yml in the repository. The workflow can install dependencies and tools or prepare the environment. When that file is absent, code review can fall back to an existing copilot-setup-steps.yml.

A precise review instruction might read: “For changes under src/billing/, require a test for signature failure and reject logging of the raw webhook body.” The condition names a path, a failure case, and forbidden behaviour. Broad praise or “review carefully” adds little.

The July update also put code review behind a firewall by default on eligible hosted runners. Admins can configure its internet access apart from Copilot cloud agent. Self-hosted review runners do not get that firewall, so the team must set its own network boundary.

Agent skills and Model Context Protocol servers can provide review context. GitHub says review is more likely to use them when names and instructions point clearly to relevant issue or incident data. Keep access narrow and verify which external data appeared in the review.

Can Copilot Approve Pull Requests or Block Merges?

Copilot can approve a pull request only when the approval preview is enabled under the required policies. By default it submits comments, and its findings do not block a merge. An approval assessment in a summary is not itself an approving review.

Some files are excluded from code review. GitHub’s current list includes dependency management files such as package.json and Gemfile.lock, log files, and SVG files. Teams that rely on lockfile, manifest, or generated-asset review need separate checks.

By default Copilot returns a non-blocking Comment review status. It does not request changes or block merging. Approvals that count toward the required-approval rule exist only in a public preview that admins switch on, with optional file-path limits, and GitHub dismisses that approval when new commits arrive. Keep human approval and deterministic gates such as tests, type checks, static analysis, and security scans.

Every suggested fix still needs careful human inspection. Check the diff, run the relevant test, and confirm the edit preserves behaviour outside the reported line. Sending a suggestion to cloud agent creates more code to review; it does not prove that the finding is settled.

Track misses as carefully as accepted comments. If a human finds a severe bug after Copilot ran, add it to the trial set. Replaying known misses shows whether new instructions, Balanced effort, or a product update altered the result.

What We Changed in Our Review Process

We removed mandatory Copilot review from one of our repositories on July 19, 2026. The comments were advisory and noisy in that workflow, so Codex became the primary release reviewer and CodeRabbit remained optional.

That was one repository. Repository mix, instructions, effort level, and product updates can lead to another result.

That experience showed why someone needs to take responsibility for the reviewer. An automatic reviewer needs someone to measure accepted findings, repeated comments, misses, and cost. Do not keep a noisy reviewer mandatory just because you already pay for Copilot.

Test Effort and Repository Context

Use the four-week review trial to measure verified findings, incorrect comments, developer time and spend. For Copilot, compare Lite with Balanced on the same kind of change and check whether repository instructions were actually used.

Also inspect a run where setup fails. Copilot can continue with reduced context, so a completed review does not prove that all context tools worked.

When Should You Choose a Dedicated AI Reviewer?

Choose a dedicated AI reviewer when Copilot’s feedback, file coverage, hosting options or reporting do not meet your needs. Copilot remains convenient for teams already using GitHub, so test the limitation before adding another service.

A dedicated reviewer may justify its bill if you need different controls, reports, Git hosts or review settings. Compare confirmed findings and total review cost with CodeRabbit, Qodo, or Graphite Agent on the same pull requests.

Another tool does not remove the human gate. Two bots can repeat the same wrong claim and create twice the reading. Give each reviewer a purpose, such as fast baseline coverage or security-sensitive analysis, then remove overlap that does not lead to fixes.

Use the broader GitHub Copilot guide to assess the rest of the product. Copilot can still earn a seat through completions, chat, agents, or CLI work even when its pull-request reviewer does not fit the repository.

My Verdict

GitHub Copilot code review should get the first measured trial when a team already pays for Copilot and keeps its pull requests on GitHub. Manual requests, current instructions, Lite effort, and a small known-bug set provide enough evidence without adding a vendor.

Keep it when confirmed findings justify AI Credit use, runner minutes, and developer attention. Remove the automatic rule or bring in a dedicated reviewer when noise, misses, excluded files, or review ownership outweigh GitHub-native convenience. Keep human approval required unless you have named an owner for bot-approved merges.

Frequently Asked Questions

Which model does Copilot code review use?

GitHub Copilot code review uses a GitHub-managed combination of models, prompts and review tools. You cannot select its model through the Copilot Chat model picker, and organisation Chat model settings do not control code review.

Can Copilot review files beyond the diff?

Copilot can inspect repository files beyond the pull-request diff to understand related code. That context depends on the available review tools and runner setup. If setup fails, Copilot may still return a review with reduced context.

Does Copilot answer replies to its review comments?

Copilot does not read or answer replies in its code-review comment threads. Those replies remain useful to human reviewers. Use the documented review controls to request another pass, or a separate cloud-agent task to implement a confirmed fix.