GitHub Copilot Integrates Code Review
GitHub Copilot is expanding its capabilities beyond code generation to include more advanced code review and security features. Recent updates show integration with CodeQL for automated security analysis. The platform is also introducing management and auditing features for its new "Copilot agents," allowing organizations to better oversee how AI is used in the development lifecycle.
- The "pull request summaries" feature, now part of the Copilot Enterprise plan, evolved from a technical preview called "Copilot for PRs" which concluded in December 2023. This tool automatically generates a prose summary and a bulleted list of changes to provide context for reviewers. - A new AI-powered secret scanning feature analyzes the context of where potential secrets are used in the code, which has been shown to reduce false positives by up to 94% compared to traditional detection methods. - The GitHub Copilot Autofix feature suggests specific code changes to remediate vulnerabilities found by CodeQL's static analysis scans. This is available for all public repositories, as well as private ones with a GitHub Advanced Security license. - Many of the advanced review and security capabilities are included in the GitHub Copilot Enterprise plan, which was made generally available on February 27, 2024, for $39 per user, per month. - When assigned as a reviewer, Copilot provides comments and suggestions but always submits a "Comment" review rather than an "Approve" or "Request changes" action, meaning it cannot directly block a pull request from being merged. - Organizations can customize the behavior of Copilot's code review by adding `copilot-instructions.md` files to their repositories, allowing them to define specific standards and priorities for the AI to focus on. - In addition to CodeQL, the code review feature is being updated to integrate with other static analysis tools such as ESLint and PMD to provide a wider range of quality and style checks. - The Enterprise plan offers more extensive administrative oversight than the Business plan, including more detailed policy controls and telemetry on how developers are using the AI assistant.
