ReleaseBytes
github GitHub Changelog ·

GitHub Copilot code review gets more configurable and secure

aiengineer
feature security

GitHub Copilot's code review functionality has been significantly enhanced with new customization options, including custom instructions from the head branch and support for multiple instruction file types. Administrators can now define custom setup steps and leverage a firewall for enhanced security, giving them greater control over the review process. These improvements are available now for most users, though self-hosted runners currently do not support the firewall feature.

  • →Firewall enabled by default for network access restriction
  • →Custom instructions now read from the head branch
  • →Expanded custom instruction file support
  • →Custom setup steps for Copilot code review environment
  • →Separate runner configurations for Copilot code review and cloud agent
Security (1) ›
  • Firewall enabled by default for network access restriction

    Copilot code review now runs behind a firewall by default, restricting network access during reviews. This firewall is configurable independently from the Copilot cloud agent in repository and organization settings, with an exception for self-hosted runners.

Enhancements (4) ›
  • Custom instructions now read from the head branch

    Copilot code review now reads custom instructions from the head branch of a pull request, including copilot-instructions.md, *.instructions.md, agent skills, and AGENTS.md. This change allows for easier iteration and testing of custom instructions within a feature branch before merging.

  • Expanded custom instruction file support

    Copilot code review now recognizes REVIEW.md, GEMINI.md, and CLAUDE.md files in addition to existing formats. This enables the automatic incorporation of team-defined review guidelines or model-specific instructions into the review process.

  • Custom setup steps for Copilot code review environment

    A new copilot-code-review.yml file in the .github/workflows/ directory allows users to define runtime environment configurations for Copilot code review. This includes installing dependencies, configuring runners, and setting up tooling specific to the code review process.

  • Separate runner configurations for Copilot code review and cloud agent

    Organization-level runner configurations are now split into distinct sections for Copilot code review and Copilot cloud agent. This allows for independent selection of runner types for each agent, providing more granular control over resource allocation.

Read the original announcement →

https://github.blog/changelog/2026-07-17-copilot-code-review-customization-and-configurability-improvements

Related releases