In a nutshell
Copilot Code Review is a feature that lets you assign Copilot as a reviewer — manually or automatically.
Once assigned, Copilot reads the code's intent and returns inline comments, a PR summary, and fix suggestions.
💡 Analogy: A junior reviewer on call 24/7. Hand off all the basic feedback — style, null safety, test coverage — so humans can focus on design, business logic, and mentoring.
Strengths of Copilot Code Review
- 🧠 Understands context — grasps code intent and returns inline comments, PR summaries, and fix suggestions
- ⚙️ Automation — can run automatically at the Repo / Org / Enterprise level
- 📜 Customizable — define review standards in
copilot-instructions.md/AGENTS.md - 🔧 Fix suggestions — apply fixes one by one or all at once
- 🖥️ Smooth UI — review and apply suggested changes via diff view in VS Code / GitHub.com
- 🛡️ Respects content exclusion — honors Repo / Org / Enterprise Copilot content-exclusion paths, keeping sensitive or irrelevant files out of review context
- 🔎 Transparency — everything is traceable via Actions logs and agent sessions
Impact data
A leading automotive and manufacturing customer in Japan (Sep 2025 – Feb 2026, median PR open duration).
💰 Business value: Shorter time from PR approval to merge — development lead time shrinks, time-to-market improves. Exceptionally high ROI.
How to use it
| Where | Trigger | What happens |
|---|---|---|
| GitHub.com manual review | Add Copilot to the Reviewers on a PR | Inline comments + PR Overview returned within minutes (on draft PRs, request it instantly via the Request button next to Copilot) |
| GitHub.com automatic review | Enable “auto-review on PR creation” in Repo / Org / Enterprise settings | All new PRs are reviewed automatically (deploy org-wide in 3 steps) |
| VS Code | Run Copilot: Review uncommitted changes from the Source Control panel | Instant review of uncommitted changes → self-check before push |
| GitHub CLI | Run /review in the terminal | Review the current working tree / branch diff inline — no editor needed |
| GitHub CLI (rubber duck) | Discuss design or implementation approach → bounce ideas off the rubber-duck agent | Catch blind spots, logic gaps, and alternatives before implementing → prevent rework |
Setting up automatic review
Enable “auto-review on PR creation” via a Ruleset. Choose scope at Repo / Org / Enterprise level.
| Scope | Settings path | Key options |
|---|---|---|
| Repository | Repo → Settings → Code and automation → Rules → Rulesets → New branch ruleset | ✅ Automatically request Copilot code review ✅ Review new pushes ✅ Review draft pull requests |
| Organization | Org → Settings → Repository → Rulesets → New branch ruleset | Target repositories by pattern (e.g. *-feature) |
| Enterprise | Enterprise → Policies → Rulesets | Force-apply to all Orgs — centralized governance |
📘 Official guide: Configure automatic code review — with screenshots
Customization
Define review standards by just adding files to your repo — Copilot code review reads them automatically.
| Source | Location | Use |
|---|---|---|
copilot-instructions.md | .github/copilot-instructions.md | Repo-wide review standards (the 4000-character limit has been removed — long, detailed instructions are honored in full) |
NAME.instructions.md | under .github/instructions/ | Extra instructions scoped via applyTo to specific paths or languages |
AGENTS.md | repository root | If an AGENTS.md already exists, it’s used as context automatically — share the same conventions across Cloud Agent / CLI |
💡 Key point: If you already run on
AGENTS.md, the same conventions apply to reviews with zero extra setup. What is AGENTS.md? ↗📘 Official guide: Adding repository custom instructions for GitHub Copilot — covers all three file types and which features support them
Governance & runner controls
Copilot code review runs on an agentic architecture, executing on GitHub Actions runners (consuming Actions minutes since 2026-06-01). Org admins can govern the execution environment centrally.
| Control | Settings path | What you can do |
|---|---|---|
| Runner type (Org) | Org → Copilot → Runner type → Runner type configuration | Set a default runner (standard / large / self-hosted) across all repos. Lock it to override per-repo settings. Applies to both code review and Cloud Agent |
| Content exclusion | Repo / Org / Enterprise settings (path-based rules) | Exclude sensitive or irrelevant files/directories from review context |
🔧 Shaping the runner environment: Control runner size / self-hosted / Windows switching via
copilot-setup-steps.yml. See Cloud Agent ↗ (same mechanism as Code Review).
Review depth, cost, and agents 📖 Docs
Choose the default review effort for automatic reviews. AI-credit consumption generally rises with pull request size and repository custom instructions.
| Effort | Estimated AI credits per review | Analysis approach |
|---|---|---|
| Lite | $0.05 to $1 USD | An ensemble of agents checks the change from separate perspectives, then combines the findings into one review |
| Balanced | $0.25 to $5 USD | For pull requests that need deeper analysis |
Since September 2026, Lite uses an ensemble of agents rather than a single reviewer. In experiments, this raised addressed high-severity comments by 47% on average while reducing review cost by about 8%.
💰 These estimates exclude GitHub Actions minutes. Reviews still run when Actions is unavailable, but agentic features such as full-project context gathering are unavailable.
Limits and the human role
Copilot Code Review is powerful but not omniscient. Humans still own these areas:
- Business logic correctness — comparing against requirements and specs is beyond AI
- Deep security analysis — combine with dedicated tools like CodeQL for SAST / SCA
- Design review — architecture, module boundaries, and trade-off discussions
- Mentoring — explaining why code should be written a certain way to teammates
🎯 Division of labor: AI handles basic feedback, style, null safety, and missing tests, freeing humans for the high-value work of design, requirements, and team growth.