What Happened
GitHub made three changes relevant to teams operating AI-assisted development workflows:
- Broader usage reporting: The Copilot usage metrics API now includes model requests from additional tools, including OpenCode. A new totals_by_client breakdown reports requests, sessions, tokens and model usage across enterprise, organization and user reports. Client attribution is best-effort, and these figures count model calls—not prompts or completed agent jobs. Access requires the Copilot usage metrics policy and an eligible permission. [1]
- Copilot actions in Microsoft Teams: An updated GitHub app combines notifications with Copilot. A team can mention @GitHub to investigate an issue and create a pull request for review. Existing notification-app users should update; users of the separate legacy app must migrate before its November 16 retirement. [2]
- Leaked-secret triage: GitHub public monitoring now supports alert dismissal and reopening, activity timelines, credential-validity labels, a REST API and an enterprise webhook. It remains in public preview. Closing an alert neither revokes a credential nor removes it from a public repository. [3]
Why It Matters to Businesses
AI coding activity increasingly crosses tool and chat boundaries. Broader client reporting gives platform teams a better view of Copilot model consumption outside traditional IDE reports, while the Teams integration shortens the path from notification to proposed code change. Neither change replaces review: usage totals do not measure developer productivity, and a pull request created from chat still needs normal tests and approvals. [1][2]
For security teams, validity labels can help prioritize exposed credentials, while APIs and webhooks make it easier to route findings into existing incident processes. An Active label is a triage signal; remediation still requires revocation or rotation and assessment of possible misuse. [3]
Kimbodo Engineering Perspective
We would treat these updates as workflow integrations, not reasons to rebuild the development platform. The useful distinction is between visibility, code generation and remediation: each needs a different owner and success measure. Compare client-level model consumption with cost and adoption trends, but do not infer completed work from request counts. Let chat initiate investigations, but keep repository permissions, branch protections and human review as the control points. [1][2]
How We Would Implement It
- Enable the required metrics policy, grant reporting access through the narrowest suitable role, and ingest daily client and model breakdowns into a cost dashboard. Preserve the API’s definitions so requests are not mislabeled as prompts or jobs. [1]
- Pilot the consolidated GitHub Teams app with a small repository group. Verify notification routing, who can invoke Copilot, and that generated pull requests enter the existing CI and review process; migrate legacy-app users before retirement. [2]
- Connect public-monitoring webhooks or the REST API to incident intake. Deduplicate alerts, prioritize supported credentials labeled Active, and require an explicit rotation or revocation task before closure. [3]
Risks, Costs and Security
Best-effort client attribution can misclassify usage, so avoid using it for individual performance judgments. Review token consumption by model before setting budgets. Limit who can see user-level reporting and who can trigger repository actions from Teams. Public-monitoring automation should handle duplicate events and Unknown validity without treating dismissal as remediation. The monitoring feature is included at no extra cost with eligible GitHub security products, but incident response and integration still carry operating costs. [1][2][3]
Where Kimbodo Comes In
Kimbodo builds and operates this in production for businesses — see our AI Application Development practice, or Estimate My AI Application.
