What changed
GitHub has made Copilot code review requestable through its REST and GraphQL APIs. A script, CI workflow, or internal developer tool can now ask Copilot to review a pull request without requiring a person to open the Reviewers menu first. Each request can also choose a review-effort level. GitHub says the change is generally available across Copilot Pro, Pro+, Max, Business, and Enterprise plans.
The same update makes Balanced the default review effort for new and existing repositories and organizations that have not explicitly selected Lite. GitHub says that default took effect on September 28, while the API announcement landed on October 2. See the official changelog.
Why it matters
This moves AI code review from a convenient UI action toward a reusable delivery primitive. Teams can attach review to the systems that already know when a change is important: pull-request creation, release branches, security-sensitive paths, or an internal change-management workflow. The useful shift is not simply that Copilot can find bugs; it is that review can now be placed inside a product’s own control flow.
The effort setting makes that control flow more realistic. A team can reserve deeper analysis for cross-service or security-sensitive changes and use a lighter pass for routine work. GitHub describes Balanced as deeper analysis of complex logic, security-sensitive code, and cross-service changes, while noting that it uses more AI credits and may use more GitHub Actions minutes.
The cost and governance catch
Programmability also makes budgeting part of the feature. GitHub’s documentation estimates roughly $0.05–$1 of AI-credit consumption for a Lite review and $0.25–$5 for Balanced, before GitHub Actions minutes. Actual usage varies with pull-request size and repository instructions, and GitHub notes that the ranges can change as models evolve.
Automatic review, approvals, and API-triggered review are separate decisions. By default, Copilot leaves a comment review rather than an approval, and administrators can configure whether automatic reviews run on new pull requests, new pushes, or draft pull requests. That separation matters: an automated reviewer can be part of the path without silently becoming the final merge authority.
The Copilot code-review guide also documents repository custom instructions, agent skills, and MCP servers as additional context sources. In other words, teams can make the review process more specific to their architecture and operating rules instead of treating every repository as an anonymous code dump.
Product takeaway
For builders, the most interesting pattern is risk-aware automation: trigger review from the workflow, choose depth based on the change, and keep human approval as an explicit policy boundary. The API makes Copilot code review easier to compose; the effort setting makes it easier to operate at scale; the budget and approval controls determine whether the resulting system is actually sustainable.
If you are evaluating AI review for a production repository, start with a narrow path—such as security-sensitive pull requests or changes crossing service boundaries—measure findings against review cost, and keep the default merge policy human-controlled. GitHub’s configuration guide covers the organization and repository controls behind that rollout.