How to Adopt GitHub’s New Copilot Agents, Stacked PRs and Actions $/ Syntax Without Breaking Security or CI

What Happened

Between July 2026 product updates and platform changes, GitHub delivered multiple releases affecting CI, agents, code review, and model access:

• GitHub Models (playground, model catalog, inference API, BYOK) was retired and is no longer available; Microsoft Foundry and GitHub Copilot are the recommended alternatives [1].
• Actions gained a self-repository reference syntax ($/) that resolves to the exact commit running and removes the need for checkout or hardcoded pins for in-repo actions/workflows (requires Actions runner v2.336.0+) [2].
• Copilot app and product updates added stacked sessions and stacked pull requests to support dependency-ordered, layerable PR workflows; stacked PRs are in public preview with CLI tooling (gh-stack) and will integrate with merge queues progressively [3][4].
• Copilot integrations expanded across IDEs: Visual Studio added a Copilot Chat Agent preview, built-in .NET/Azure skills, selection review actions, and org-level custom instructions; VS Code releases added redesigned Agents UI, multi-chat for Claude, Copilot Vision GA, BYOK model use in the Agents window, and other editor/terminal accessibility and workflow features [5][7].
• Enterprise controls improved: remoteControl setting lets admins limit which devices can host remotely controlled Copilot sessions (requireSSO/disabled/enabled) with server-, MDM-, or file-based deployment options [6].
• Copilot code review agent skills (SKILL.md in .github/skills) and MCP (multi-context pull) server integrations are now generally available; MCPs pull read-only third-party context into reviews and generated comments are attributed [8].

Why It Matters to Businesses

These changes affect developer productivity, release safety, and governance:

• Model availability and supplier risk. Retirement of GitHub Models forces teams to re-map BYOM/BYOK flows to Microsoft Foundry or other providers and audit integration paths for inference and keys [1].
• Safer, more reviewable large changes. Stacked PRs let teams split large migrations into ordered, reviewable layers and land entire stacks while preserving independent reviews and protections—reducing merge conflicts and review friction for complex refactors [3][4].
• More deterministic CI and in-repo composition. The $/ self-repo syntax preserves commit-SHA pinning without manual checkout, improving traceability and easing enterprise policies that require full-SHA pins [2].
• Agent-driven and IDE workflows are maturing. Copilot agents, multi-chat, Copilot Vision, and built-in skills reduce friction for code generation and review inside IDEs but increase the need for policy controls and auditability across devices and repos [5][7].
• Expanded external context in automated reviews. MCP servers and agent skills let code-review automation consume third-party data (issues, docs, playbooks) to produce more context-aware comments—but also introduce new secrets, boundary, and trust considerations [8].

Kimbodo Engineering Perspective

Practical judgment and trade-offs for technology leaders:

• Map BYOK/BYOM dependencies now. With GitHub Models removed, teams must inventory any tooling that relied on GitHub-hosted inference and plan migration to Microsoft Foundry or alternative LLM providers. Consider latency, compliance and re-authorization costs when switching providers [1].
• Adopt $/ for in-repo composition when you need strict reproducibility. Use $/ to avoid checkout-heavy workflows and preserve SHA pinning, but enforce runner upgrades (v2.336.0+) and update enterprise documentation to prevent older runners from breaking builds [2].
• Use stacked PRs for layered migrations but keep small, testable layers. Stacked PRs reduce cognitive load for reviewers; keep layers focused and independently testable to minimize rebasing complexity and CI flakiness when stacks re-target or auto-rebase during partial merges [3][4].
• Treat agent outputs as assistive, not authoritative. Agents and MCP-driven reviews improve throughput but can hallucinate or surface stale external context—retain human-in-loop sign-off for security- or compliance-sensitive changes and enforce review policies that mandate manual verification for certain file paths or dependencies [5][8].
• Enforce device and session controls for remote Copilot sessions. Remote control settings (requireSSO/MDM) should be part of onboarding for enterprise Copilot usage to reduce the attack surface introduced by remotely hosted sessions [6].
• Plan for secrets and token governance for MCPs. MCP integrations use tokens that must be stored in secrets; apply least-privilege tokens, rotation policies, and audit logging to all MCPs and agent secret stores [8].

How We Would Implement It

1) Immediate actions (30–60 days)

• Inventory any pipelines or features that called GitHub Models and create a migration plan to Microsoft Foundry or another provider; update architecture diagrams and SLA/latency expectations [1].
• Upgrade Actions runners to v2.336.0+ in CI fleets; test workflows that switch from ./ or checkout-based references to $/ and validate commit-SHA behavior in staging [2].
• Trial stacked PRs on a non-critical repo: install gh-stack extension, train teams on creating ordered stacks, and define merge-queue behavior for stacks before enabling on critical repos [4].

2) Agent and code-review integration (60–120 days)

• Enable Copilot agents in IDEs used by your teams (VS Code, Visual Studio). Roll out built-in skills for .NET/Azure only where workloads are installed and governance allows; configure org-level custom instructions where consistent guidance is required [5][7].
• Create repository SKILL.md files under .github/skills for code-review expectations and safety constraints; test MCP integrations in a read-only mode connecting one external system (e.g., issue tracker) to validate token handling and attribution [8].
• Implement remoteControl policy: requireSSO for enterprise orgs with sensitive code, use MDM-managed deployments for corporate devices, and adopt file-based policies only for well-controlled build hosts [6].

3) Production hardening (120+ days)

• Integrate MCP tokens into centralized secret management (e.g., Vault or cloud secrets manager) with automated rotation and audit logging; enforce least privilege on MCP scopes [8].
• Integrate stacked PR workflows into merge-queue strategy and CI gating—define policies for which layers may be auto-merged and set mandatory tests for each layer to avoid subtle regressions on rebase/retarget [3][4].
• Standardize repository templates to use $/ for self-repo composition, include CI test suites that validate reproducible behavior for pinned SHAs, and document runner versioning requirements [2].
• For model access, implement a provider-agnostic abstraction layer for inference calls (adapter pattern) so model endpoints, auth and telemetry can be swapped without code-level changes; route sensitive workloads via vetted providers (e.g., Foundry) with contractual protections [1].

Risks, Costs and Security

• Vendor and tooling churn. Retirement of GitHub Models is a concrete example—expect provider-side deprecations; build abstraction layers to reduce migration cost and re-certification effort [1].
• Runner and CI compatibility costs. Enforcing Actions runner upgrades to use $/ may require phased upgrades, additional testing, and temporary duplicated runners to avoid disruptions [2].
• Agent and MCP trust boundaries. MCP servers read external context into reviews; even read-only connectors increase privacy/exposure of repository metadata and require strict token governance, logging and review of connectors before production enablement [8].
• Device and session risk. Remote Copilot control increases the attack surface if unmanaged devices are allowed; requireSSO and MDM-managed modes mitigate risks but add operational overhead for device management [6].
• Human oversight and hallucination risk. Agent-generated code and reviews accelerate development but require guardrails: mandatory human approval gates for security-critical files, enforced test coverage for auto-merged stacks, and periodic sampling audits of agent suggestions [5][8].
• License and seat costs. Advanced Copilot features (org-level settings, MCC/MCP, Business/Enterprise add-ons) carry seat and licensing costs—run a cost-benefit with pilot metrics (time saved per PR, review cycle reduction) before full rollout.

Sources

1. [1] GitHub Models is now retired
2. [2] Reference same-repository actions with self-repository syntax
3. [3] Stacked sessions and pull requests in the GitHub Copilot app
4. [4] Stacked pull requests are now in public preview
5. [5] GitHub Copilot in Visual Studio — July update
6. [6] Limit remote control to managed devices
7. [7] GitHub Copilot in Visual Studio Code, July 2026 releases
8. [8] Copilot code review: Agent skills and MCP now generally available