Make Copilot Review Configuration Observable From Pull Request to Finding

Primary source: https://github.blog/changelog/2026-07-17-copilot-code-review-customization-and-configurability-improvements/.

GitHub expanded Copilot code-review customization on July 17. Teams now need a cross-layer answer to a simple question: which configuration produced this finding?

type ReviewRun={
  pullRequest:string; baseSha:string; headSha:string;
  configDigest:string; startedAt:string;
  findings:{path:string,line:number,rule:string}[];
};

Render the digest in the UI, persist it with findings, and return it from the API. If configuration changes while a review runs, finish against the pinned digest or cancel and restart—never silently mix policies.

Failure	Expected state
config missing	blocked or explicit default
config changes mid-run	stale marker
duplicate webhook	same review-run key
PR head advances	old findings marked obsolete

An end-to-end fixture should create a PR, start review, change configuration, and prove the original findings retain their provenance. Rollback disables customized review while preserving historical records.

This is an implementation pattern, not documentation of GitHub's internal schema. Which identifier would you need during an incident: config digest, base SHA, model, or all three?