Originally published at IndieSeek.
GitHub Copilot code review approvals: protect merge requirements before enabling public preview
Quick answer
GitHub Copilot code review can now submit an approving pull-request review, and administrators can optionally let that approval satisfy a repository's required-approval rule. The feature is a public preview, is off by default, and is available on Copilot Pro, Pro+, Max, Business, and Enterprise plans.
Do not treat every positive Copilot assessment as merge authority. GitHub exposes three separate states: an approval assessment in the review summary, permission for Copilot to submit an approving review, and permission for that approval to count toward merge requirements. Keep the third state disabled until a path-scoped canary proves stale-approval dismissal, required checks, code-owner review, and bypass rules still behave as intended.
Who this is for
This guide is for repository administrators, platform teams, and indie developers who already use Copilot code review and are deciding whether an AI approval may become part of the merge gate. It focuses on GitHub.com governance, not on IDE suggestion quality or letting an agent merge code.
If you still need to tune review instructions and effort, start with the Copilot code-review setup guide. For security findings and deterministic scanning, use the Copilot and code-scanning workflow. Neither article previously allowed an AI review to satisfy a required approval; this public preview changes that exact boundary.
What changed—and what did not
Every Copilot code review now includes an approval assessment in its overview comment. That assessment only reports Copilot's judgment; by itself, it does not count toward merge requirements. When administrators enable approvals, Copilot can submit an approving review. A second control decides whether that approval can satisfy the repository's required-approval rule.
Controls exist at enterprise, organization, and repository levels. Repository administrators can also provide up to 15 file globs. An approval counts only when every changed file matches the configured globs. New commits dismiss Copilot's approval, after which a fresh review can be requested.
This is not automatic merge. Required status checks, conversation resolution, code-owner requirements, deployments, merge queue rules, and non-bypass settings remain independent controls. GitHub also says Copilot can miss problems and should be supplemented with human review.
Model the three gates separately
| Gate | Default behavior | What it proves | What it does not prove |
|---|---|---|---|
| Approval assessment | Appears in every Copilot review | Copilot considers the reviewed revision ready or not ready | No approving review and no merge credit |
| Copilot may approve | Off by default | Copilot may submit an approving review | Approval may still not satisfy required reviews |
| Copilot approval counts | Separately configurable | The approval may satisfy one required-approval slot when scope matches | CI, code owners, latest-push rules, and merge authority are not bypassed |
Treat the first gate as information, the second as reviewer authority, and the third as enforcement authority. Roll them out in that order.
Build a narrow approval envelope
Start with low-risk paths where review correctness can be tested without making the AI the sole risk owner. Documentation, examples, and generated snapshots may be candidates; authentication, billing, secrets, deployment, migrations, dependency manifests, and security policy should remain human-gated.
Use branch protection or rulesets to keep the envelope bounded:
- require at least two approvals when one may come from Copilot;
- require Code Owner review for sensitive paths;
- dismiss stale approvals after code-modifying pushes;
- require approval of the most recent reviewable push;
- require named CI checks from the expected GitHub App;
- require conversation resolution and disallow bypass for the protected branch.
File globs are an eligibility filter, not a security boundary. A mixed pull request containing one file outside the allowlist should not receive merge credit from Copilot. Also remember that Copilot reads instructions and agent skills from the pull request's head branch, so a change to review instructions deserves explicit human scrutiny.
A six-stage rollout workflow
1. Snapshot the existing merge contract
Record the active ruleset or branch-protection rule, required approval count, code owners, required checks and their expected apps, latest-push rule, dismissal rule, merge queue, deployments, and bypass actors. If you cannot reproduce the current contract, do not add another approval actor.
2. Enable assessment only
Run Copilot reviews without enabling approval authority. Compare the overview assessment with human reviewers across at least ten representative pull requests. Capture false positives, missed risk, excluded files, review effort, AI-credit usage, and Actions-minute impact.
3. Allow approvals without merge credit
Enable “Allow Copilot to approve pull requests,” but leave “Allow Copilot approvals to count toward merge requirements” off. Confirm the review event, actor, reviewed commit SHA, timestamp, and audit visibility. This separates event correctness from enforcement.
4. Add path-scoped merge credit
Use a small repository or a narrow set of file globs. Keep at least one required human approval. Do not leave the path list blank for the first canary, because blank means approvals can count for all files.
5. Run the canary matrix
| Canary pull request | Expected result |
|---|---|
| All files match the low-risk globs | Copilot approval may count, but other gates remain required |
| One file is outside the globs | Copilot approval must not satisfy merge requirements |
| New commit after approval | Copilot approval is dismissed; re-review is required |
| Required CI check fails | Merge remains blocked |
| CODEOWNERS path changes | Required Code Owner approval remains necessary |
| Review instructions change in the head branch | Human reviewer inspects the policy change before merge |
Stop if the merge box cannot explain which approval and rule satisfied each gate.
6. Expand only from evidence
Promote one path group at a time. Review false-approval rate, human override rate, escaped defects, spend, and bypass events. Roll back by disabling merge credit first; disabling Copilot's ability to approve is a second, separate rollback.
Copyable acceptance record
feature: github-copilot-code-review-approvals
preview_status: public-preview
repository: owner/example
protected_branch: main
copilot_may_approve: true
copilot_approval_counts: true
allowed_paths:
- "docs/**"
- "examples/**"
required_approvals: 2
human_approval_minimum: 1
dismiss_stale_reviews: true
require_last_push_approval: true
required_checks_source_pinned: true
code_owner_gate_preserved: true
bypass_disabled: true
canary_matrix_passed: true
rollback_owner: platform-admin@example.com
review_date: 2026-10-02
Building something? Take a 60-sec game break. Score to rank your product or profile on tapto.top and get more exposure—free, no signup.
Common mistakes
- Counting the overview assessment as an approving review.
- Enabling merge credit enterprise-wide before a repository canary.
- Leaving file paths blank and assuming that means “no paths.”
- Reducing required approvals to one, allowing Copilot to become the only approver.
- Forgetting that new commits require a fresh Copilot review.
- Treating an AI approval as proof that tests, Code Owners, or deployment gates passed.
- Ignoring head-branch changes to instructions, skills, or MCP context used during review.
FAQ
Does every positive Copilot assessment count as approval?
No. The assessment is informational. Copilot must be allowed to submit approvals, and a separate setting must allow those approvals to count toward merge requirements.
Is the approval feature generally available?
No. GitHub labels Copilot approvals as public preview and says the behavior is subject to change.
Can Copilot approval merge a pull request automatically?
No. An approval can satisfy one review requirement, but merge permission and every other protection rule remain separate.
What happens after another commit is pushed?
GitHub says Copilot's approval is dismissed. Request a new review and verify the new head SHA before relying on another approval.
Top comments (0)