What Happened
GitHub made REST API endpoints generally available for retrieving and updating Copilot model policies across enterprises, enterprise teams, enterprise apps, and organizations. Enterprises can delegate model control to organizations or, in enterprise teams mode, to teams and apps. [1]
GitHub deprecated six Copilot models on October 19, 2026. The stated replacements are Gemini 3.8 Flash for Gemini 3.7 Flash; GPT-6.1 Sol for GPT-5.5 and GPT-5.4; GPT-6 Luna for GPT-5.4 mini and GPT-5 mini; and Grok 4.7 for Grok 4.5. Workflows that select models explicitly need updating, and Copilot Enterprise administrators may need to enable replacements in their policies. [2]
Developers can now use Open in VS Code to continue a GitHub Copilot app session with its conversation, diff, branch, and isolated worktree intact. They can review and test locally before pushing the session branch to update its existing pull request. [3]
A separate tooling change affects code security: with Xcode 27 installed, CodeQL traced extraction is unavailable for C/C++, C#, Go, Java, Kotlin, and Swift; macOS 27 may also affect it. CodeQL does not support Swift 6.4 on any platform. GitHub advises pinning scans to macOS 26 and Xcode 26 or earlier; C/C++, C#, and Java users can alternatively use build mode none. [4]
Why It Matters to Businesses
Model selection is becoming an operational policy, not just a developer preference. A replacement model may be supported but unavailable to a team until an administrator enables it. Explicit model references in automation can also outlive the model they name. Policy ownership, approved models, and workflow configuration therefore need to be managed together. [1][2]
Moving a Copilot session into VS Code gives developers a practical route from generated changes to local testing and pull-request review. It does not remove the need for normal repository approvals. Meanwhile, an unsupported CodeQL extraction path can interrupt a security check even when the application code has not changed. [3][4]
Kimbodo Engineering Perspective
We would separate model governance from code acceptance. A central policy should define which models teams may use; repository controls should determine whether resulting code can merge. Delegating model control can reduce central administration, but it also requires clear ownership and periodic review of team- and app-level permissions. [1][3]
We would treat model deprecations and scanner compatibility as planned dependency changes. Pinning an older macOS and Xcode image is a sensible short-term way to preserve CodeQL coverage, but it creates an image-upgrade backlog. Build mode none is an option only for the languages GitHub identifies and should be validated against each repository’s scan requirements. [2][4]
How We Would Implement It
- Inventory Copilot model selections in policies, integrations, and team instructions; replace deprecated names and confirm the approved replacements are enabled for the intended users. [1][2]
- Use the Copilot policy GET and PATCH endpoints to record approved settings, apply changes through a controlled process, and check for drift across enterprise, organization, team, and app scopes. [1]
- Document the VS Code handoff as a review workflow: inspect the carried-over diff, run local tests and checks, then push to the existing pull request for normal approval. [3]
- Audit CodeQL runners and Xcode versions before upgrades. Pin affected traced-extraction jobs to supported versions, or test build mode none where GitHub offers it. Track Swift 6.4 separately because it is unsupported on every platform. [4]
Risks, Costs and Security
Policy delegation can create inconsistent model access if nobody owns the resulting settings. Model replacements require validation of cost, output quality, and workflow compatibility rather than a name-only substitution. Preserved Copilot sessions make review easier, but their diffs still require testing and human approval. [1][2][3]
Keeping older macOS and Xcode images available has maintenance costs; upgrading without a CodeQL plan risks losing traced extraction. Scan status should be checked after any runner, Xcode, Swift, or build-mode change. [4]
These notes establish specific GitHub, VS Code, and CodeQL changes; they do not establish new releases for Cursor, Windsurf, Replit, Sourcegraph, JetBrains, or Continue.dev.
Where Kimbodo Comes In
Kimbodo builds and operates this in production for businesses — see our AI Application Development practice, or Estimate My AI Application.
