标签：#Copilot

Copilot now bills usage at listed API rates. Compare direct model access with the coding workflow, policy, and harness work around it. The post Copilot vs. raw API access: What are you actually paying for? appeared first on The GitHub Blog .

Canvases turn AI into interactive workspaces where you can visualize information, explore workflows, and take action across complex tasks. The post How to build interactive experiences with canvases appeared first on The GitHub Blog .

A team lead asks the question in a planning meeting and the room splits three ways: do we build this agent in Copilot Studio, write the orchestration ourselves and host it, or hand our container to Foundry and let it run our code? All three are official Microsoft build paths in 2026, all three end up in the same tenant-wide agent inventory, and the wrong pick costs you a rebuild once the project outgrows it. The answer is not "the most powerful one." It is the one whose service model matches who is building the agent, who owns the runtime, and how much pro-code control over orchestration and protocols you actually need. This article is the decision framework for that choice, grounded in Microsoft Learn and current as of mid-2026. Two of these three paths are public preview, so this is a guide to architectural fit and direction, not a production-reliability scorecard. TL;DR Three build paths, picked by service model, not power. Copilot Studio: low-code managed SaaS for makers. GA. Foundry Hosted agents: managed PaaS runtime for your own container. Public preview. Microsoft 365 Agents SDK: pro-code, self-hosted, widest channel reach. Agent Framework orchestrator in public preview. Monday move: before picking a platform, write down four things for this agent - who builds it (maker or pro-dev), who must own the compute, what channels it has to reach, and whether you need custom protocols or background/async behavior. Those four answers pick the path more reliably than a feature checklist. The three paths in one paragraph each Microsoft's own Cloud Adoption Framework frames the build options as three service tiers, which is the cleanest mental model to start from. The CAF positions them as Copilot Studio (SaaS, no/low-code), Microsoft Foundry (PaaS, pro-code or low-code), and GPUs and Containers (IaaS, code-first frameworks for maximum flexibility). The first two are managed by Microsoft. The third is where the self-hosted SDK path lives when you own the compute end to e

An accepted AI suggestion is an event, not a durable outcome. If the code is rewritten tomorrow, acceptance rate still calls it a success. For an adoption review, I would connect three timestamps: suggestion : accepted_at : 2026-07-19T09:00:00Z repository : api task_type : test change : retained_lines_24h : 31 rewritten_lines_24h : 9 reverted_at : null review : human_minutes : 12 incident_link : null Then report a funnel rather than one flattering percentage: shown → accepted → merged → retained_24h → retained_14d A useful unit is cost per retained task : (tool cost + review labor + rework labor) / retained tasks “Retained” needs a written contract. For example: the change remains merged after 14 days, passes required checks, and has not caused a linked rollback. Line survival alone is weak because formatting and refactoring can change lines without rejecting the solution. Segment the result by task type and repository. Boilerplate tests and unfamiliar security changes should not be blended into one portfolio average. Also publish counter-metrics: review time, escaped defects, rollback rate, and developer-reported interruption. GitHub documents available fields and limitations in its Copilot metrics API . Those product metrics can be inputs, but the retained-task join belongs to the adopting organization and should be versioned like any other analytics contract. My pilot gate would be simple: expand only if retained-task cost beats the existing workflow without worsening rollback rate. Otherwise, change the workflow before buying more seats. Record the baseline before enabling the tool, and keep one comparable task cohort outside the rollout; without that counterfactual, a rising retention rate may only reflect easier work entering the sample. What retention window would make an accepted change meaningful for your team?

GitHub announced enterprise-managed OpenTelemetry export for Copilot activity from VS Code and Copilot CLI on July 8, 2026. Primary source: GitHub Changelog, July 8, 2026 . Export availability is only the start. The receiving collector becomes an enterprise ingress point. This is an unexecuted operating plan; signal types, attributes, endpoint requirements, and controls must be checked against current GitHub documentation. Isolate the path managed clients -> private telemetry ingress -> dedicated OTel Collector pool -> field policy + bounded queue -> dedicated backend dataset Do not point every developer client directly at the primary observability backend. Give the collector write-only destination credentials, separate its dataset from production application telemetry, and define retention before rollout. Isolation is not anonymity. Stable user, device, organization, or repository identifiers may still be sensitive. Start with a field budget Category Initial policy Product and version Keep bounded values Operation and status Keep documented enums Timing and counts Keep numeric measures Raw prompts or generated code Drop by default File paths and repository URLs Drop or transform after review User identity Prefer scoped pseudonymous identity Free-form errors Drop raw text; keep reviewed classes These categories are recommendations, not a description of GitHub's payload. Inspect a restricted canary before naming actual keys. processors : memory_limiter : check_interval : 1s limit_mib : 512 spike_limit_mib : 128 attributes/field_budget : actions : # Illustrative keys only; replace after payload review. - key : user.email action : delete - key : file.path action : delete - key : command.arguments action : delete batch : send_batch_size : 512 timeout : 5s Verify processors against the chosen Collector distribution. A valid startup does not prove that records satisfy policy. Drill three failures Backend outage: block the exporter. Retries must be bounded, queue growth vi

GitHub announced Copilot Vision general availability on July 1, 2026, allowing developers to attach screenshots to Copilot conversations as visual context. Primary source: GitHub Changelog, “Copilot Vision is generally available” . A screenshot can shorten “make this component look like that.” It can also become an invisible source of truth: unlabeled attachment controls, image-only requirements, generated markup with no semantics, and an error state communicated only by a thumbnail badge. The accessibility target should be stronger than “a screen reader can upload a file.” A keyboard or screen-reader user must be able to understand the supplied requirements, remove or replace the image, follow processing state, and verify the generated interface. Add a text contract beside the screenshot Use a structured alternative, not a filename: <fieldset> <legend> Reference design </legend> <label for= "shot" > Screenshot </label> <input id= "shot" type= "file" accept= "image/png,image/jpeg" /> <label for= "requirements" > Required behavior and content </label> <textarea id= "requirements" aria-describedby= "requirements-help" ></textarea> <p id= "requirements-help" > Describe text, controls, order, states, and behavior that must not be inferred from appearance alone. </p> <p id= "upload-status" role= "status" aria-live= "polite" ></p> </fieldset> Example text contract: Dialog title: Delete workspace? Body: This cannot be undone. Focus starts on Cancel. Tab order: Cancel, Delete, close button. Escape closes and returns focus to the launch button. Delete is destructive; color is not its only indicator. The screenshot communicates spacing and visual hierarchy. The text carries names, order, behavior, and safety requirements. Model attachment states explicitly type AttachmentState = | { kind : ' empty ' } | { kind : ' reading ' ; name : string } | { kind : ' ready ' ; name : string ; alt : string } | { kind : ' error ' ; name : string ; message : string }; Render each state with

GitHub announced on July 14, 2026 that security reviews are available in the GitHub Copilot app. Primary source: GitHub Changelog, July 14, 2026 . The meaningful research question is not whether people click Accept. It is whether they can build an evidence-backed decision when guidance is useful, incomplete, or wrong. understand change -> inspect evidence -> challenge findings -> verify uncertainty -> accept, reject, or escalate This is a proposed research protocol, not a completed study. It does not invent product fields or report findings. Build scenario cards scenario_id : " SR-03" repository_type : " synthetic" seeded_conditions : - " one relevant issue" - " one plausible but irrelevant concern" - " one important omission" participant_goal : " ready, blocked, or escalate" success_evidence : - " decision cites inspected code" - " unsupported claim is challenged" - " unresolved uncertainty is recorded" stop_conditions : - " real credentials appear" - " a live repository could be modified" - " participant mistakes study output for production approval" Vary the seeded mix so participants cannot learn that every scenario contains exactly one true and one false finding. Establish ground truth independently before sessions. Recruit people who hold different review responsibilities: routine reviewers, maintainers, security specialists, less-experienced reviewers, and people using keyboard navigation or assistive technology. Do not collapse every group into one average. Require a decision record Decision: ready | blocked | escalate Evidence inspected: - file and relevant lines - test or documentation Guidance accepted: - claim and evidence Guidance rejected: - claim and reason Unresolved: - question and next owner Spoken confidence is not the outcome. This artifact exposes whether acceptance connects to evidence. Measure relevant issues identified, unsupported claims challenged, evidence references, correct escalation, time, and confidence before and after inspection. No

GitHub announced on July 8, 2026 that GitHub Mobile can start a Copilot cloud-agent workflow to fix pull-request merge conflicts. Primary source: GitHub Changelog, July 8, 2026 . The unsafe mental model is “tap once and the conflict is solved.” A safer model is: mobile intent -> bounded remote task -> proposed patch -> verification -> human merge This is a source-based checklist, not a hands-on product assessment. Exact controls and permissions must come from current GitHub documentation. Record the handoff repository : " owner/project" pull_request : 123 base_branch : " main" expected_base_sha : " <commit>" expected_head_sha : " <commit>" allowed_scope : - " src/example/**" - " tests/example/**" forbidden_scope : - " .github/workflows/**" - " deployment/**" required_checks : - " unit-tests" reviewer : " <responsible human>" expires_at : " <UTC timestamp>" This operator artifact is not a representation of the mobile UI. It preserves intent across interruptions, network changes, and the delay between delegation and review. Before handoff, confirm repository, pull request, branches, expected files, sensitive paths, required checks, and the person responsible for merge. Never place secrets, customer data, or private incident details in the instruction. A bounded instruction is better than “make CI green”: Resolve conflicts between the recorded base and head revisions. Preserve documented behavior, limit changes to the listed paths, do not modify workflow or deployment configuration, and return a patch without merging. Verify the returned revision the result belongs to the expected repository and pull request; base and head revisions still match the handoff; every changed file is expected or explained; no conflict markers remain; no workflow, ownership, deployment, or policy file changed unexpectedly; tests ran against the exact reviewed commit; tests were not weakened or removed; a human can explain the semantic choice made for each conflict; the reviewed commit is the

GitHub announced on July 14, 2026 that Copilot for JetBrains expanded bring-your-own-key capabilities. Primary source: GitHub Changelog, July 14, 2026 . Provider and model selection looks like two dropdowns, but behaves like one dependent workflow: credential context -> provider -> compatible models -> confirmed session This is a proposed accessibility test plan, not a hands-on review. It does not claim that the current product has an accessibility defect. Test outcomes, not widget assumptions A keyboard or screen-reader user should be able to reach the provider control, discover its name and current value, inspect options, commit or cancel, understand that model choices changed, and select a compatible model without losing context. Use this matrix: Case Action Keyboard expectation Screen-reader expectation State expectation P1 Reach provider Visible focus Name, role, value No change P2 Open options Documented key works Expanded state is clear Existing value retained P3 Browse providers No focus escape Option and selection announced Browsing does not commit P4 Select provider Pointer not required New value announced once Model refresh begins M1 Reach model after refresh Focus not stolen Availability communicated Options match provider M2 Search models Keys do not conflict Query and result are clear Search does not select R1 Change provider later No trap Invalidated model explained Stale pair cannot submit E1 Loading fails Retry/cancel reachable Error and next action announced Last valid state is clear The matrix separates interaction, announcement, and state correctness. A control can pass one and fail another. Record the environment ide : " <product and exact version>" plugin : " GitHub Copilot <exact version>" os : " <name and version>" assistive_technology : " <name and version>" keymap : " <default or named alternative>" initial_state : " <unconfigured or existing selection>" Vary one versus many providers, short versus long model names, loaded/loading/empty/err

GitHub announced on July 2, 2026 that Copilot CLI no longer needs a personal access token when it runs in GitHub Actions. Primary source: GitHub Changelog, July 2, 2026 . Deleting a secret is easy. Proving the workflow still works—and recovering without hurriedly pasting credentials back into YAML—is the useful part. This is an unexecuted migration template, not a report from a production repository. Make one reversible change First find every place the old secret enters the job, including reusable workflows: git grep -nE 'COPILOT_PAT|COPILOT_GITHUB_TOKEN|GH_TOKEN|github_pat' Record the workflow, job, pinned CLI version, permissions block, and previous known-good commit. Never print environment variables while debugging. Then remove only the PAT injection. Do not upgrade the runner and CLI in the same patch. jobs: copilot-check: permissions: contents: read - env: - COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_PAT }} steps: - uses: actions/checkout@<PINNED_COMMIT> - run: ./scripts/setup-copilot-cli.sh - run: ./scripts/run-bounded-check.sh The scripts are placeholders for repository-owned commands. “No PAT required” does not mean “no identity or permissions exist”; follow the current setup documentation and keep permissions explicit. Add a canary with two proofs The canary should show that the legacy token is absent and that the existing bounded task still satisfies its output contract. name : copilot-cli-auth-canary on : workflow_dispatch permissions : contents : read jobs : canary : runs-on : ubuntu-latest timeout-minutes : 10 steps : - uses : actions/checkout@<PINNED_COMMIT> - name : Verify legacy PAT is absent run : | test -z "${COPILOT_PAT:-}" test -z "${COPILOT_GITHUB_TOKEN:-}" - run : ./scripts/setup-copilot-cli.sh - run : copilot --version - run : ./scripts/run-bounded-check.sh Use a read-only, cheap task. “Fix whatever you find” is not a canary; it is a small deployment wearing a fake mustache. Define pass criteria before clicking Run: absent legacy variables, e

Where Copilot's telemetry stream lands, decided centrally GitHub added a control on July 8 that lets an enterprise mandate where the Copilot Chat extension in VS Code and Copilot CLI send OpenTelemetry data, removing the need for individual developers to set OTEL_* environment variables. Per the GitHub changelog, the setting is delivered through a telemetry block in the enterprise-managed settings, and a managed value takes precedence over environment variables and user settings. Four things are configurable in the block: the OTLP export endpoint and transport ( otlp-http or otlp-grpc ), the OTel service name and resource attributes, exporter headers such as an authentication token for the collector, and whether prompt, response and tool content is captured, with a separate flag for whether developers can change that. Delivery uses the channels documented on the same page: native MDM (Windows Registry or macOS managed preferences), server-managed settings from a signed-in GitHub account, or a file-based managed-settings.json . Where this bites The precedence rule is the point. If a platform team owns the collector and needs traces routed to it, this is exactly the switch they wanted. If a developer had their own OTLP endpoint pointed at a local sink, they will see the session start emitting somewhere else. The changelog does not describe a per-user override once a managed value is set. A scoping note is worth reading twice. The changelog states that managed exporter headers apply only to the Copilot Chat extension's OTLP exporter. The endpoint and transport policy still reach the CLI agent host, but the auth-token flow the changelog calls out is bound to the Chat surface. On-call teams standing up the collector should plan for that asymmetry before it lands as a surprise during triage.

How migrating Copilot code review to shared Unix-style code exploration tools reduced review cost by reshaping agent workflows around pull request evidence. The post Better tools made Copilot code review worse. Here’s how we actually improved it. appeared first on The GitHub Blog .

GitHub has made the redesigned GitHub Copilot CLI terminal interface generally available. It adds a tabbed layout for sessions, gists, issues, and pull requests; an in-session, form-driven setup for MCP servers, skills, and plugins that avoids hand-editing config files; and a cleaner, theme-aware, more accessible UI with screen reader support. By Mark Silvester

OpenAI's new family of models will continue to power Microsoft's suite of workplace and productivity apps.

Explore how the Aspire team turns merged product changes into SME-reviewed docs pull requests, closing the gap between release and documentation. The post Automating cross-repo documentation with GitHub Agentic Workflows appeared first on The GitHub Blog .

Go from an empty repository to a live custom domain with HTTPS in about 14 minutes, without manually editing a single DNS record. The post How GitHub Copilot enables zero DNS configuration for GitHub Pages appeared first on The GitHub Blog .

GA in a sentence GitHub moved its enterprise managed-settings.json to general availability on July 1, giving GitHub Enterprise Cloud admins a single JSON file that overrides Copilot behaviour in VS Code and Copilot CLI for anyone holding a Copilot Business or Copilot Enterprise seat issued from the enterprise or one of its organizations. The changelog frames it as a place to define AI standards for the tenant. In practice it is a supported home for Copilot policy that shipped one setting at a time in beta up to this point. The five keys the file accepts Five keys are documented at GA: extraKnownMarketplaces , enabledPlugins , strictKnownMarketplaces , disableBypassPermissionsMode , and model . Together they configure trust for extra plugin marketplaces, the enabled-plugins list, strict enforcement of the known-good marketplace list, whether Copilot CLI and the VS Code extension can run in bypass-permission mode, and which model a user is allowed to pick. Value shapes are not enumerated in the changelog itself; the docs page is the reference for the schema. How the file reaches a client The file lives at copilot/managed-settings.json inside the .github-private repository of the organization the enterprise nominates for the role. There is a backward-compatible path at .github/copilot/settings.json for tenants already using the older layout. Copilot clients fetch the file from the server on every authentication, hold it in memory, and refresh it hourly, per the changelog. That server-side file takes precedence over the file-based config a user may have on their own machine. Setup runs through the AI Controls tab in enterprise settings, or the equivalent API endpoint, where an admin picks the hosting organization. Anyone who followed the June rollouts of disableBypassPermissionsMode and strictKnownMarketplaces will recognise the same file and the same repo. GA is what turns the plumbing into a supported product surface. Where it will trip you Two operational details are

GitHub said this week that Copilot CLI, when it runs inside a GitHub Actions workflow, will accept the built-in GITHUB_TOKEN for authentication. Per the July 2 changelog, the previous path required creating and storing a personal access token. The operational read is small and precise: one fewer human-owned credential to mint, rotate and inherit. The exact scope of the change The changelog covers a narrow surface. It applies to Copilot CLI when invoked from a GitHub Actions workflow, and it swaps the required credential from a PAT to the workflow's ambient GITHUB_TOKEN . GitHub does not describe changes to how Copilot CLI authenticates outside Actions, and this post will not extrapolate to those contexts. If your Copilot CLI usage lives on a developer laptop or in another CI system, nothing in this announcement moves for you. Why the PAT was the wrong credential to leave in the loop A personal access token has almost none of the properties you would want from an automation credential. It does not expire on a job boundary. It carries a person's identity, not the workflow's. It sits in Actions secrets long enough to outlive the engineer who created it. And its scopes were chosen by that engineer, at that moment, often wider than the job actually needs. GITHUB_TOKEN is the opposite shape. Actions mints it at the start of a job, scopes it through the workflow's permissions: block, and revokes it when the job ends. If the token leaks, the window for abuse is the runtime of the job, not the years until somebody remembers to rotate it. When the person who wrote the workflow leaves, the pipeline does not silently break because a token expired with their account. For scripted Copilot CLI calls that had to be wrapped in a PAT, that is the whole win. The tool authenticates against the workflow instead of against a human. Wiring it up The workflow-side pattern is the same one every GITHUB_TOKEN -consuming step already follows: declare permissions: explicitly at the job level, k

We are so excited to finally announce the winners of the GitHub Finish-Up-A-Thon Challenge, our...

Microsoft has announced the limited public preview of Copilot Autofix for GitHub Advanced Security for Azure DevOps, extending AI-powered vulnerability remediation to teams using Azure Repos. By Craig Risi