标签：#githubcopilot

An accepted AI suggestion is an event, not a durable outcome. If the code is rewritten tomorrow, acceptance rate still calls it a success. For an adoption review, I would connect three timestamps: suggestion : accepted_at : 2026-07-19T09:00:00Z repository : api task_type : test change : retained_lines_24h : 31 rewritten_lines_24h : 9 reverted_at : null review : human_minutes : 12 incident_link : null Then report a funnel rather than one flattering percentage: shown → accepted → merged → retained_24h → retained_14d A useful unit is cost per retained task : (tool cost + review labor + rework labor) / retained tasks “Retained” needs a written contract. For example: the change remains merged after 14 days, passes required checks, and has not caused a linked rollback. Line survival alone is weak because formatting and refactoring can change lines without rejecting the solution. Segment the result by task type and repository. Boilerplate tests and unfamiliar security changes should not be blended into one portfolio average. Also publish counter-metrics: review time, escaped defects, rollback rate, and developer-reported interruption. GitHub documents available fields and limitations in its Copilot metrics API . Those product metrics can be inputs, but the retained-task join belongs to the adopting organization and should be versioned like any other analytics contract. My pilot gate would be simple: expand only if retained-task cost beats the existing workflow without worsening rollback rate. Otherwise, change the workflow before buying more seats. Record the baseline before enabling the tool, and keep one comparable task cohort outside the rollout; without that counterfactual, a rising retention rate may only reflect easier work entering the sample. What retention window would make an accepted change meaningful for your team?

GitHub announced enterprise-managed OpenTelemetry export for Copilot activity from VS Code and Copilot CLI on July 8, 2026. Primary source: GitHub Changelog, July 8, 2026 . Export availability is only the start. The receiving collector becomes an enterprise ingress point. This is an unexecuted operating plan; signal types, attributes, endpoint requirements, and controls must be checked against current GitHub documentation. Isolate the path managed clients -> private telemetry ingress -> dedicated OTel Collector pool -> field policy + bounded queue -> dedicated backend dataset Do not point every developer client directly at the primary observability backend. Give the collector write-only destination credentials, separate its dataset from production application telemetry, and define retention before rollout. Isolation is not anonymity. Stable user, device, organization, or repository identifiers may still be sensitive. Start with a field budget Category Initial policy Product and version Keep bounded values Operation and status Keep documented enums Timing and counts Keep numeric measures Raw prompts or generated code Drop by default File paths and repository URLs Drop or transform after review User identity Prefer scoped pseudonymous identity Free-form errors Drop raw text; keep reviewed classes These categories are recommendations, not a description of GitHub's payload. Inspect a restricted canary before naming actual keys. processors : memory_limiter : check_interval : 1s limit_mib : 512 spike_limit_mib : 128 attributes/field_budget : actions : # Illustrative keys only; replace after payload review. - key : user.email action : delete - key : file.path action : delete - key : command.arguments action : delete batch : send_batch_size : 512 timeout : 5s Verify processors against the chosen Collector distribution. A valid startup does not prove that records satisfy policy. Drill three failures Backend outage: block the exporter. Retries must be bounded, queue growth vi

GitHub announced Copilot Vision general availability on July 1, 2026, allowing developers to attach screenshots to Copilot conversations as visual context. Primary source: GitHub Changelog, “Copilot Vision is generally available” . A screenshot can shorten “make this component look like that.” It can also become an invisible source of truth: unlabeled attachment controls, image-only requirements, generated markup with no semantics, and an error state communicated only by a thumbnail badge. The accessibility target should be stronger than “a screen reader can upload a file.” A keyboard or screen-reader user must be able to understand the supplied requirements, remove or replace the image, follow processing state, and verify the generated interface. Add a text contract beside the screenshot Use a structured alternative, not a filename: <fieldset> <legend> Reference design </legend> <label for= "shot" > Screenshot </label> <input id= "shot" type= "file" accept= "image/png,image/jpeg" /> <label for= "requirements" > Required behavior and content </label> <textarea id= "requirements" aria-describedby= "requirements-help" ></textarea> <p id= "requirements-help" > Describe text, controls, order, states, and behavior that must not be inferred from appearance alone. </p> <p id= "upload-status" role= "status" aria-live= "polite" ></p> </fieldset> Example text contract: Dialog title: Delete workspace? Body: This cannot be undone. Focus starts on Cancel. Tab order: Cancel, Delete, close button. Escape closes and returns focus to the launch button. Delete is destructive; color is not its only indicator. The screenshot communicates spacing and visual hierarchy. The text carries names, order, behavior, and safety requirements. Model attachment states explicitly type AttachmentState = | { kind : ' empty ' } | { kind : ' reading ' ; name : string } | { kind : ' ready ' ; name : string ; alt : string } | { kind : ' error ' ; name : string ; message : string }; Render each state with

GitHub announced on July 14, 2026 that security reviews are available in the GitHub Copilot app. Primary source: GitHub Changelog, July 14, 2026 . The meaningful research question is not whether people click Accept. It is whether they can build an evidence-backed decision when guidance is useful, incomplete, or wrong. understand change -> inspect evidence -> challenge findings -> verify uncertainty -> accept, reject, or escalate This is a proposed research protocol, not a completed study. It does not invent product fields or report findings. Build scenario cards scenario_id : " SR-03" repository_type : " synthetic" seeded_conditions : - " one relevant issue" - " one plausible but irrelevant concern" - " one important omission" participant_goal : " ready, blocked, or escalate" success_evidence : - " decision cites inspected code" - " unsupported claim is challenged" - " unresolved uncertainty is recorded" stop_conditions : - " real credentials appear" - " a live repository could be modified" - " participant mistakes study output for production approval" Vary the seeded mix so participants cannot learn that every scenario contains exactly one true and one false finding. Establish ground truth independently before sessions. Recruit people who hold different review responsibilities: routine reviewers, maintainers, security specialists, less-experienced reviewers, and people using keyboard navigation or assistive technology. Do not collapse every group into one average. Require a decision record Decision: ready | blocked | escalate Evidence inspected: - file and relevant lines - test or documentation Guidance accepted: - claim and evidence Guidance rejected: - claim and reason Unresolved: - question and next owner Spoken confidence is not the outcome. This artifact exposes whether acceptance connects to evidence. Measure relevant issues identified, unsupported claims challenged, evidence references, correct escalation, time, and confidence before and after inspection. No

GitHub announced on July 8, 2026 that GitHub Mobile can start a Copilot cloud-agent workflow to fix pull-request merge conflicts. Primary source: GitHub Changelog, July 8, 2026 . The unsafe mental model is “tap once and the conflict is solved.” A safer model is: mobile intent -> bounded remote task -> proposed patch -> verification -> human merge This is a source-based checklist, not a hands-on product assessment. Exact controls and permissions must come from current GitHub documentation. Record the handoff repository : " owner/project" pull_request : 123 base_branch : " main" expected_base_sha : " <commit>" expected_head_sha : " <commit>" allowed_scope : - " src/example/**" - " tests/example/**" forbidden_scope : - " .github/workflows/**" - " deployment/**" required_checks : - " unit-tests" reviewer : " <responsible human>" expires_at : " <UTC timestamp>" This operator artifact is not a representation of the mobile UI. It preserves intent across interruptions, network changes, and the delay between delegation and review. Before handoff, confirm repository, pull request, branches, expected files, sensitive paths, required checks, and the person responsible for merge. Never place secrets, customer data, or private incident details in the instruction. A bounded instruction is better than “make CI green”: Resolve conflicts between the recorded base and head revisions. Preserve documented behavior, limit changes to the listed paths, do not modify workflow or deployment configuration, and return a patch without merging. Verify the returned revision the result belongs to the expected repository and pull request; base and head revisions still match the handoff; every changed file is expected or explained; no conflict markers remain; no workflow, ownership, deployment, or policy file changed unexpectedly; tests ran against the exact reviewed commit; tests were not weakened or removed; a human can explain the semantic choice made for each conflict; the reviewed commit is the

GitHub announced on July 14, 2026 that Copilot for JetBrains expanded bring-your-own-key capabilities. Primary source: GitHub Changelog, July 14, 2026 . Provider and model selection looks like two dropdowns, but behaves like one dependent workflow: credential context -> provider -> compatible models -> confirmed session This is a proposed accessibility test plan, not a hands-on review. It does not claim that the current product has an accessibility defect. Test outcomes, not widget assumptions A keyboard or screen-reader user should be able to reach the provider control, discover its name and current value, inspect options, commit or cancel, understand that model choices changed, and select a compatible model without losing context. Use this matrix: Case Action Keyboard expectation Screen-reader expectation State expectation P1 Reach provider Visible focus Name, role, value No change P2 Open options Documented key works Expanded state is clear Existing value retained P3 Browse providers No focus escape Option and selection announced Browsing does not commit P4 Select provider Pointer not required New value announced once Model refresh begins M1 Reach model after refresh Focus not stolen Availability communicated Options match provider M2 Search models Keys do not conflict Query and result are clear Search does not select R1 Change provider later No trap Invalidated model explained Stale pair cannot submit E1 Loading fails Retry/cancel reachable Error and next action announced Last valid state is clear The matrix separates interaction, announcement, and state correctness. A control can pass one and fail another. Record the environment ide : " <product and exact version>" plugin : " GitHub Copilot <exact version>" os : " <name and version>" assistive_technology : " <name and version>" keymap : " <default or named alternative>" initial_state : " <unconfigured or existing selection>" Vary one versus many providers, short versus long model names, loaded/loading/empty/err

GitHub announced on July 2, 2026 that Copilot CLI no longer needs a personal access token when it runs in GitHub Actions. Primary source: GitHub Changelog, July 2, 2026 . Deleting a secret is easy. Proving the workflow still works—and recovering without hurriedly pasting credentials back into YAML—is the useful part. This is an unexecuted migration template, not a report from a production repository. Make one reversible change First find every place the old secret enters the job, including reusable workflows: git grep -nE 'COPILOT_PAT|COPILOT_GITHUB_TOKEN|GH_TOKEN|github_pat' Record the workflow, job, pinned CLI version, permissions block, and previous known-good commit. Never print environment variables while debugging. Then remove only the PAT injection. Do not upgrade the runner and CLI in the same patch. jobs: copilot-check: permissions: contents: read - env: - COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_PAT }} steps: - uses: actions/checkout@<PINNED_COMMIT> - run: ./scripts/setup-copilot-cli.sh - run: ./scripts/run-bounded-check.sh The scripts are placeholders for repository-owned commands. “No PAT required” does not mean “no identity or permissions exist”; follow the current setup documentation and keep permissions explicit. Add a canary with two proofs The canary should show that the legacy token is absent and that the existing bounded task still satisfies its output contract. name : copilot-cli-auth-canary on : workflow_dispatch permissions : contents : read jobs : canary : runs-on : ubuntu-latest timeout-minutes : 10 steps : - uses : actions/checkout@<PINNED_COMMIT> - name : Verify legacy PAT is absent run : | test -z "${COPILOT_PAT:-}" test -z "${COPILOT_GITHUB_TOKEN:-}" - run : ./scripts/setup-copilot-cli.sh - run : copilot --version - run : ./scripts/run-bounded-check.sh Use a read-only, cheap task. “Fix whatever you find” is not a canary; it is a small deployment wearing a fake mustache. Define pass criteria before clicking Run: absent legacy variables, e

Where Copilot's telemetry stream lands, decided centrally GitHub added a control on July 8 that lets an enterprise mandate where the Copilot Chat extension in VS Code and Copilot CLI send OpenTelemetry data, removing the need for individual developers to set OTEL_* environment variables. Per the GitHub changelog, the setting is delivered through a telemetry block in the enterprise-managed settings, and a managed value takes precedence over environment variables and user settings. Four things are configurable in the block: the OTLP export endpoint and transport ( otlp-http or otlp-grpc ), the OTel service name and resource attributes, exporter headers such as an authentication token for the collector, and whether prompt, response and tool content is captured, with a separate flag for whether developers can change that. Delivery uses the channels documented on the same page: native MDM (Windows Registry or macOS managed preferences), server-managed settings from a signed-in GitHub account, or a file-based managed-settings.json . Where this bites The precedence rule is the point. If a platform team owns the collector and needs traces routed to it, this is exactly the switch they wanted. If a developer had their own OTLP endpoint pointed at a local sink, they will see the session start emitting somewhere else. The changelog does not describe a per-user override once a managed value is set. A scoping note is worth reading twice. The changelog states that managed exporter headers apply only to the Copilot Chat extension's OTLP exporter. The endpoint and transport policy still reach the CLI agent host, but the auth-token flow the changelog calls out is bound to the Chat surface. On-call teams standing up the collector should plan for that asymmetry before it lands as a surprise during triage.

GA in a sentence GitHub moved its enterprise managed-settings.json to general availability on July 1, giving GitHub Enterprise Cloud admins a single JSON file that overrides Copilot behaviour in VS Code and Copilot CLI for anyone holding a Copilot Business or Copilot Enterprise seat issued from the enterprise or one of its organizations. The changelog frames it as a place to define AI standards for the tenant. In practice it is a supported home for Copilot policy that shipped one setting at a time in beta up to this point. The five keys the file accepts Five keys are documented at GA: extraKnownMarketplaces , enabledPlugins , strictKnownMarketplaces , disableBypassPermissionsMode , and model . Together they configure trust for extra plugin marketplaces, the enabled-plugins list, strict enforcement of the known-good marketplace list, whether Copilot CLI and the VS Code extension can run in bypass-permission mode, and which model a user is allowed to pick. Value shapes are not enumerated in the changelog itself; the docs page is the reference for the schema. How the file reaches a client The file lives at copilot/managed-settings.json inside the .github-private repository of the organization the enterprise nominates for the role. There is a backward-compatible path at .github/copilot/settings.json for tenants already using the older layout. Copilot clients fetch the file from the server on every authentication, hold it in memory, and refresh it hourly, per the changelog. That server-side file takes precedence over the file-based config a user may have on their own machine. Setup runs through the AI Controls tab in enterprise settings, or the equivalent API endpoint, where an admin picks the hosting organization. Anyone who followed the June rollouts of disableBypassPermissionsMode and strictKnownMarketplaces will recognise the same file and the same repo. GA is what turns the plumbing into a supported product surface. Where it will trip you Two operational details are

We are so excited to finally announce the winners of the GitHub Finish-Up-A-Thon Challenge, our...

For the last few years, many enterprise AI conversations have started with the same question: “Where can we add an AI copilot?” It is an understandable starting point. Copilots are familiar. They sit inside existing tools, help users draft content, summarize information, search documents, write code, or answer questions. For teams experimenting with AI, they feel safe. But after 10 years of building mobile apps, web platforms, AI systems, internal tools, and enterprise-grade products, I have learned something that sounds simple but changes the whole strategy: The workflow is the product. Not the chatbot. Not the prompt box. Not the model. Not the dashboard. The workflow. Enterprise AI only becomes valuable when it changes how work actually moves across people, systems, approvals, decisions, and data. That is why companies now need to move beyond standalone copilots and toward AI workflow automation, enterprise AI agents, and agentic workflows that are designed around real operational outcomes. Copilots Help. Workflows Transform. An AI copilot is useful when a person needs assistance inside a task. It can draft an email, summarize a meeting, search policy documents, or help an engineer understand code. These are valuable use cases. But they usually improve a single moment of work, not the complete business process. A workflow, on the other hand, connects the full chain. For example, consider enterprise customer onboarding. A copilot may summarize the sales call. A workflow system can take that summary, extract requirements, identify missing information, create onboarding tasks, notify customer success, update the CRM, generate a kickoff plan, check billing setup, and flag delivery risks. That is a very different level of impact. AI Copilot AI Workflow Automation Assists one user Coordinates work across teams Responds when asked Triggers actions automatically Works inside a tool Connects multiple systems Improves productivity Improves operating performance Helps with

Hey all, we have a quick update for everyone who participated in the Github "Finish-Up-A-Thon"...

As of June 1, 2026, all GitHub Copilot plans run on usage-based billing. Premium request units are gone. What replaced them is a token-metered currency called GitHub AI Credits: one credit equals one cent, and every model interaction converts into credits based on the input, output, and cached tokens it consumes, charged at each model's published rate. GitHub's framing is that Copilot outgrew its old pricing. A one-line completion and a multi-hour autonomous run used to cost the same, and once agentic use went mainstream, that flat rate stopped matching the compute behind it. Tying the price to tokens fixes the mismatch. If your Copilot use is mostly autocomplete, this barely registers. If you drive Copilot as an agent from the terminal, it changes which moves cost money. Here's the practical shape of it. Requests out, tokens in Old model: each interaction cost one premium request, scaled by a per-model multiplier, drawn from a monthly request allowance. New model: each interaction costs whatever its tokens cost on the model you picked. Every paid plan still ships with a monthly pool, now denominated in credits, with the option to set a budget for usage past it. Published figures put the included pool at 1,500 credits for Pro, 7,000 for Pro+, and 20,000 for Max, with pooled per-user allowances on Business and Enterprise. Worth knowing if you pay yearly: annual Pro and Pro+ subscribers stay on the request-based model until the term ends, and several model multipliers went up for them on June 1. An annual plan doesn't dodge the change. It postpones part of it while making the strong models eat more of the old allowance. Autocomplete is untouched Before anyone starts rationing, here's the part that didn't move. Inline completions and Next Edit Suggestions are still unlimited and still free. If your day is mostly tab-completion in the editor, your costs read identical to May. Nothing to monitor there. The meter lands on the rest: chat, and especially the agentic runs th

GitHub added a tiny field to the Copilot usage metrics API this week that is going to create a lot of very confident spreadsheets. Enterprise and organization admins can now see ai_credits_used in the user-level Copilot usage reports. One field. Per user. Available for single-day and 28-day reports. It is not the invoice, and GitHub is careful to say it is a consumption signal rather than a billed total. Still, the shape is obvious. Now AI usage can sit next to adoption, activity, team, department, cost center, and whatever else the company already exports into a dashboard. That is useful. It is also exactly how a tool metric becomes a management metric. And once that happens, the question is no longer "can we measure AI usage?" The question is "what weird behavior will this metric create?" every useful metric becomes a temptation I understand why this field exists. If a company is paying for Copilot, especially with usage-based pieces attached to more expensive models and premium features, it needs some way to understand consumption. Platform teams need budget signals. Engineering leaders need adoption signals. Procurement needs something more concrete than "people seem to like it." Finance will eventually ask why one org burns through credits much faster than another. That is normal. The problem starts when a consumption signal is treated as a productivity signal. High AI credit usage might mean a developer is doing valuable work with agent mode, code review, test generation, refactoring, or research. It might also mean the developer is stuck, repeatedly asking the model to solve the wrong problem, generating code that gets deleted, or using a heavyweight model where a small one would have been fine. Low AI credit usage might mean a developer does not need much help. It might mean the work is mostly design, review, debugging, incident response, mentoring, or architecture. It might mean the codebase is small and well understood. It might mean the developer is skept

From Confused to Confident: How I Finally Mastered GitHub Copilot in Every Situation I still remember the afternoon I rage-closed VS Code because Copilot kept suggesting the wrong function signatures — again . I had been treating it like a magic oracle, typing vague comments and expecting perfect code to rain down from the AI heavens. Spoiler: that's not how it works. After weeks of trial, error, and a few embarrassing pull request reviews, I cracked the code (pun intended). Here's everything I wish someone had told me about using GitHub Copilot accurately — across Chat , Plan , and Agent modes. 🧠 First, Understand What Copilot Actually Is Before diving into tips, let's reset expectations. GitHub Copilot is not a search engine. It's not Stack Overflow with a fancy UI. It's a context-aware AI assistant trained on massive amounts of code. That means: The quality of your output depends directly on the quality of your input . It works best when it has rich context — open files, good comments, clear naming. It can be wrong. Confidently wrong. Always review what it generates. With that mindset locked in, let's explore each mode. 💬 Copilot Chat: Your Pair Programmer in the Sidebar The first time I opened Copilot Chat, I typed: "fix my code." It stared back at me, basically confused. Of course it was — I hadn't told it which code, what was broken, or what I expected. Tips for Accurate Chat Usage 1. Be specific and contextual. Instead of: "Why isn't this working?" Try: "This useEffect hook in React runs on every render instead of only when userId changes. Here's the code: [paste snippet]. What's wrong?" The more context you give, the more surgical the answer. 2. Use slash commands to guide intent. Copilot Chat supports built-in commands that dramatically improve accuracy: /explain → Explains selected code in plain English /fix → Suggests a fix for a highlighted bug /tests → Generates unit tests for selected code /doc → Writes documentation for a function or class These aren'

GitHub moved Copilot Chat's richer pull request experience to general availability this week — side-by-side chat with diffs, inline editing, and context-aware answers without leaving the review view. Previously in public preview, it is now live for all Copilot license holders. It is a real improvement for reviewing changes inside a single pull request. But it highlights a gap that per-PR AI tooling structurally cannot close: knowing what is open across the rest of your organisation. The Problem That Lives Outside the PR Most engineering teams don't work in one repository. They ship across services, libraries, and infrastructure — often with related PRs open in multiple repos simultaneously. A reviewer approving a payments service change without knowing that a dependent auth-service PR is still in draft is reviewing without full context. This is not a quality-of-feedback problem. It is a visibility problem. No amount of intelligence surfaced inside a PR tells you what is happening across your repositories. Gartner's 2026 assessment of AI coding agents makes the point clearly: the bottleneck has shifted from generating code to reviewing, securing, and governing it. Better per-PR AI raises the floor on feedback quality. The teams that pull ahead will be the ones who also solve the coordination layer — which PRs are open, which are stale, which are blocked on a dependency in another repo. What Changes With Better In-PR AI GitHub's GA release makes the review experience faster and less disruptive for individual PRs. That matters. But as per-PR intelligence becomes table stakes, the differentiator shifts toward cross-repo awareness: who is waiting for review, what related work is in flight, and where the actual bottlenecks in the delivery pipeline are. Engineering leaders should be watching PR age distribution and review load across all repositories — not just the ones that happen to be open in a browser tab right now. For teams already dealing with multi-repo sprawl, Cod

Hey all, we have a quick update for everyone who participated in the GitHub "Finish-Up-A-Thon"...

This is a submission for the GitHub Finish-Up-A-Thon Challenge What I Built SpendWise AI is a free tool that audits your AI tool spending (Cursor, Copilot, Claude, ChatGPT, Gemini, Windsurf) against verified vendor pricing and tells you exactly where you're overspending and what to do about it. I originally built this as a week-long assignment for a startup. The problem it solves is simple: founders and engineering managers pay for multiple AI tools but have no idea if they're getting ripped off. SpendWise gives them that answer in under a minute, no signup needed. The interesting part is that the core audit engine has zero AI in it. It runs 6 hardcoded rules against verified pricing data, so every recommendation is reproducible and verifiable. AI (Groq's Llama 3) only kicks in to write a friendly summary paragraph on top of the structured results. I made this choice because financial recommendations need to be deterministic. Same input, same output, every time. The stack is Next.js 16, TypeScript, Tailwind + shadcn/ui, Supabase for the database, Groq for AI summaries, Resend for emails, and Vitest for testing. Deployed on Vercel. Live app: spendwise-ai-test.vercel.app Source code: github.com/Karam-999/SpendWise-AI Demo The original audit tool: The comeback (re-audit on pricing change): You can try the Round 1 version live at spendwise-ai-test.vercel.app . Pick a tool like Cursor on Teams plan at $40/mo, run the audit, and see the full savings breakdown. The Round 2 features (pricing change detection, re-audit diff view) are on a separate branch and not merged to main yet, but the demo video above walks through the complete flow. The Comeback Story Where it was: The original version was basically a calculator. You fill in your AI tools, it shows you where you can save money, and that's it. If Cursor changed its pricing the next week, your audit was already stale and you'd never know about it. It worked fine as a one-time thing. It had the form, the audit engine, AI

Created a Google Chrome extension that instantly turns any highlighted text on a webpage into a Google Calendar event

This is a submission for the GitHub Finish-Up-A-Thon Challenge What I Built AdeptAI is a...