What Happened
GitHub now exposes Copilot code review settings through REST and GraphQL APIs at the enterprise, organization, and repository levels. The APIs also expose review attribution, effort, and reported sources. Review overviews are more compact, group files that were not reviewed, and collect a reason for negative ratings. GitHub also added AI-credit reporting and bypass lists for automatic review rules, revised its Balanced effort review process, and shipped billing and review-reliability fixes [1].
@GitHub in Slack and Teams is generally available. Users can investigate bugs, create issues, implement changes, and open pull requests from a conversation. Teams Canvas supports shared review of plans, code changes, and previews; issues and pull requests identify the originating conversation and user [2].
These announcements establish changes for GitHub, not new releases for Cursor, Windsurf, Replit, Sourcegraph, JetBrains, VS Code, or Continue.dev. Teams using those tools should check their own changelogs before assuming equivalent capabilities.
Why It Matters to Businesses
API-managed review settings make it practical to apply and audit policies across many repositories. Attribution and effort data can help teams assess usage, but a completed AI review is not evidence that every file was examined; the new overview explicitly identifies files not reviewed [1].
Chat-to-PR workflows reduce the friction between reporting a problem and proposing a fix. They also move software-change initiation into Slack and Teams, where access, identity, and approval expectations may differ from those in the repository [2].
Kimbodo Engineering Perspective
We would treat both features as workflow integrations, not substitutes for engineering review. API policy management is most valuable where repository settings drift; chat initiation is most valuable for well-scoped, low-risk changes. Neither should allow an assistant-generated pull request to bypass tests, code-owner approval, or deployment controls. Review metrics should be interpreted alongside coverage and defect outcomes, rather than used as a proxy for code quality.
How We Would Implement It
- Set a baseline: Inventory repositories, existing review rules, billing settings, and the users and bots allowed to initiate changes.
- Manage review policy as code: Apply settings through GitHub’s APIs, reconcile drift, and test bypass lists and bot-authored pull requests in a pilot repository [1].
- Constrain chat workflows: Limit @GitHub to approved repositories and channels, preserve the originating user and conversation in the issue or pull request, and require normal branch protection and human approval [2].
- Measure the pilot: Track AI credits, review effort, files not reviewed, retry or fallback behavior, and the rate at which proposed changes pass tests and human review [1].
Risks, Costs and Security
Repository access granted through chat integrations expands the surface for unintended changes and disclosure. Apply least-privilege permissions, review retention and logging settings, and keep credentials and sensitive data out of prompts. Confirm how bypass rules interact with mandatory reviews before enabling automatic review broadly. AI-credit reporting improves cost visibility, but usage can rise as initiation becomes easier; set budgets and monitor spend during rollout [1][2].
Where Kimbodo Comes In
Kimbodo builds and operates this in production for businesses — see our AI Application Development practice, or Estimate My AI Application.
