GitHub Copilot Code Review API Settings and Attribution

GitHub updated Copilot code review on November 6, 2026 with REST and GraphQL management for settings, explicit attribution fields for Copilot comments and a more compact review overview. Enterprise, organization and repository administrators can inspect or change different settings according to their role and inherited policy. The release also includes billing, automatic-review and reliability fixes.

Policy management now extends from enterprise to repository

Enterprise administrators can enable or disable code review for organizations or delegate the choice. Organization administrators can manage enablement, default effort and runner configuration. Repository administrators can control effort and whether reviews use custom instructions or MCP tools when higher-level policy permits it.

The permission model matters: GitHub says enterprise and organization settings endpoints do not support GitHub Apps or fine-grained personal access tokens, while repository endpoints do with Administration read or write permission. Automation should use the narrowest credential and log every policy change.

Attribution fields make Copilot output easier to identify

API responses can identify Copilot reviews and comments, show effort metadata when available and list the skills, MCP servers or custom instructions reported as sources for a comment. This can help audits distinguish a person’s review from an automated finding.

Reported sources do not prove a finding is correct or reveal every influence on the model. Preserve the code revision, policy state and review output needed to reproduce an investigation, while avoiding unnecessary retention of sensitive repository content.

A compact overview reorganizes evidence; it does not grant approval

The review overview now groups skipped and excluded files, hides empty sections and moves effort and survey details into a footer. Later reviews collapse findings unrelated to the recent change. Failed or timed-out reviews receive one retry and may switch to another eligible model.

A compact summary can conceal context if reviewers stop there. Branch protections, required human approvals and test results remain the authority. Teams should inspect excluded files and treat model changes between retries as a reproducibility consideration.

Canadian teams should test governance before expanding review coverage

Regulated organizations should map who can change settings, which repositories send context to Copilot, how custom instructions are governed and how exceptions are approved. AI credit consumption is now displayed in agent sessions, but usage is not the same as benefit.

Measure confirmed defects, false positives, correction time and human change requests after AI review. A high comment count can reflect verbosity rather than safer code.

Sources and editorial method

We use the linked original statements and reports to distinguish documented facts from our analysis. Company announcements describe their authors’ plans and claims; they are not independent verification of future outcomes. This article is dated and will be revised if material evidence changes. Read our editorial standards and corrections process.

GitHub: Copilot code review API and overview updates ↗ — Official November 6 changelog; settings hierarchy, permissions, attribution, overview changes and bug fixes.