In a nutshell
Copilot Code Review is a feature that lets you assign Copilot as a reviewer โ manually or automatically.
Once assigned, Copilot reads the code's intent and returns inline comments, a PR summary, and fix suggestions.
๐ก Analogy: A junior reviewer on call 24/7. Hand off all the basic feedback โ style, null safety, test coverage โ so humans can focus on design, business logic, and mentoring.
Strengths of Copilot Code Review
- ๐ง Understands context โ grasps code intent and returns inline comments, PR summaries, and fix suggestions
- โ๏ธ Automation โ can run automatically at the Repo / Org / Enterprise level
- ๐ Customizable โ define review standards in
copilot-instructions.md/AGENTS.md - ๐ง Fix suggestions โ apply fixes one by one or all at once
- ๐ฅ๏ธ Smooth UI โ review and apply suggested changes via diff view in VS Code / GitHub.com
- ๐ก๏ธ Respects content exclusion โ honors Repo / Org / Enterprise Copilot content-exclusion paths, keeping sensitive or irrelevant files out of review context
- ๐ Transparency โ everything is traceable via Actions logs and agent sessions
Impact data
A leading automotive and manufacturing customer in Japan (Sep 2025 โ Feb 2026, median PR open duration).
๐ฐ Business value: Shorter time from PR approval to merge โ development lead time shrinks, time-to-market improves. Exceptionally high ROI.
How to use it
| Where | Trigger | What happens |
|---|---|---|
| GitHub.com manual review | Add Copilot to the Reviewers on a PR | Inline comments + PR Overview returned within minutes (on draft PRs, request it instantly via the Request button next to Copilot) |
| GitHub.com automatic review | Enable โauto-review on PR creationโ in Repo / Org / Enterprise settings | All new PRs are reviewed automatically (deploy org-wide in 3 steps) |
| VS Code | Run Copilot: Review uncommitted changes from the Source Control panel | Instant review of uncommitted changes โ self-check before push |
| GitHub CLI | Run /review in the terminal | Review the current working tree / branch diff inline โ no editor needed |
| GitHub CLI (rubber duck) | Discuss design or implementation approach โ bounce ideas off the rubber-duck agent | Catch blind spots, logic gaps, and alternatives before implementing โ prevent rework |
Setting up automatic review
Enable โauto-review on PR creationโ via a Ruleset. Choose scope at Repo / Org / Enterprise level.
| Scope | Settings path | Key options |
|---|---|---|
| Repository | Repo โ Settings โ Code and automation โ Rules โ Rulesets โ New branch ruleset | โ
Automatically request Copilot code review โ Review new pushes โ Review draft pull requests |
| Organization | Org โ Settings โ Repository โ Rulesets โ New branch ruleset | Target repositories by pattern (e.g. *-feature) |
| Enterprise | Enterprise โ Policies โ Rulesets | Force-apply to all Orgs โ centralized governance |
๐ Official guide: Configure automatic code review โ with screenshots
Customization
Define review standards by just adding files to your repo โ Copilot code review reads them automatically.
| Source | Location | Use |
|---|---|---|
copilot-instructions.md | .github/copilot-instructions.md | Repo-wide review standards (the 4000-character limit has been removed โ long, detailed instructions are honored in full) |
NAME.instructions.md | under .github/instructions/ | Extra instructions scoped via applyTo to specific paths or languages |
AGENTS.md | repository root | If an AGENTS.md already exists, itโs used as context automatically โ share the same conventions across Cloud Agent / CLI |
๐ก Key point: If you already run on
AGENTS.md, the same conventions apply to reviews with zero extra setup. What is AGENTS.md? โ๐ Official guide: Adding repository custom instructions for GitHub Copilot โ covers all three file types and which features support them
Governance & runner controls
Copilot code review runs on an agentic architecture, executing on GitHub Actions runners (consuming Actions minutes since 2026-06-01). Org admins can govern the execution environment centrally.
| Control | Settings path | What you can do |
|---|---|---|
| Runner type (Org) | Org โ Copilot โ Runner type โ Runner type configuration | Set a default runner (standard / large / self-hosted) across all repos. Lock it to override per-repo settings. Applies to both code review and Cloud Agent |
| Content exclusion | Repo / Org / Enterprise settings (path-based rules) | Exclude sensitive or irrelevant files/directories from review context |
๐ง Shaping the runner environment: Control runner size / self-hosted / Windows switching via
copilot-setup-steps.yml. See Cloud Agent โ (same mechanism as Code Review).
Limits and the human role
Copilot Code Review is powerful but not omniscient. Humans still own these areas:
- Business logic correctness โ comparing against requirements and specs is beyond AI
- Deep security analysis โ combine with dedicated tools like CodeQL for SAST / SCA
- Design review โ architecture, module boundaries, and trade-off discussions
- Mentoring โ explaining why code should be written a certain way to teammates
๐ฏ Division of labor: AI handles basic feedback, style, null safety, and missing tests, freeing humans for the high-value work of design, requirements, and team growth.