What changed
On July 17, 2026, GitHub announced a meaningful expansion of Copilot code review. The feature now reads review instructions from the pull request head branch instead of only the base branch, understands more instruction files such as REVIEW.md, CLAUDE.md, and GEMINI.md, and lets repositories define review-only setup work in copilot-code-review.yml. The same release also gives Copilot code review its own firewall behavior and separate organization-level runner controls.
Why it matters
This matters because GitHub is moving Copilot code review closer to a governed execution surface, not just a comment generator. GitHub's own docs say Copilot code review uses GitHub Actions to run agentic capabilities, and that means environment setup, runner choice, and network boundaries directly affect how useful and trustworthy the review can be. If your repository needs dependencies installed, internal tooling prepared, or heavier runners for more complex analysis, those choices now map more cleanly to code review itself instead of being shared awkwardly with other Copilot agent flows.
The product angle
The most interesting shift is governance. GitHub's firewall docs state that Copilot's internet access is limited by a firewall by default, and code review can now be configured independently from Copilot cloud agent. Combined with the new release, that gives platform teams a tighter product loop: define what review agents are allowed to reach, choose separate runner defaults, and validate repository instructions on a feature branch before merging them into the main line. That is a more enterprise-ready posture than simply adding another AI review toggle.
Builder takeaway
If you maintain a real production repository, this update reduces the gap between "Copilot can review code" and "Copilot can review code under our constraints." GitHub's instruction guidance already encourages teams to organize review context across repository-wide files, path-specific files, and AGENTS.md-style agent instructions. Now those instructions are easier to test before merge, while the runtime beneath them becomes more configurable. The practical takeaway is that AI review quality is starting to depend less on one big model upgrade and more on whether the product exposes the same control surfaces that teams already expect from CI, security, and platform tooling.
Sources
- GitHub changelog: Copilot code review customization and configurability improvements
- GitHub Docs: Configuring runners for GitHub Copilot code review
- GitHub Docs: Customizing or disabling the firewall for GitHub Copilot
- GitHub Docs: Using custom instructions to unlock the power of Copilot code review