GitHub Puts Copilot in the Approval Seat for Pull Requests

GitHub has introduced a new feature that allows its AI code review tool, Copilot, to provide formal approvals for pull requests (PRs) in addition to its existing role of offering feedback and catching bugs. This change shifts Copilot from being an advisory tool to an authoritative one in the crucial phase where PRs are merged. The approval capability is currently available as a public preview across various GitHub plans, including Pro, Pro+, Business, and Enterprise.

When enabled, Copilot’s approval counts toward the required number of approvals for a repository to merge a PR, similar to a human reviewer’s approval. However, this feature is off by default and requires administrators to actively enable it at three different levels: enterprise, organization, and repository. Each level can choose to allow, restrict, or defer Copilot’s approval authority.

For added precision, repository admins can also limit which files Copilot is allowed to approve. For instance, a team could let Copilot sign off on documentation without granting it the authority to approve code related to authentication or payment processing. This granular control helps organizations maintain a balance between automation and human oversight.

Copilot will automatically dismiss its approval if a new commit is pushed after the approval. This behavior mirrors what developers expect from human reviewers. The rollout of this feature is seen as a logical next step in GitHub’s ongoing expansion of Copilot’s capabilities, as the company has been continuously improving its review scope over the past few weeks.

Engineering leaders are now faced with the decision of how much authority to grant to an automated reviewer. While Copilot can effectively identify bugs, the bigger question lies in the level of trust an organization is willing to place in a tool that lacks accountability like a human reviewer. To earn and maintain this trust, engineering leaders should monitor the effectiveness of Copilot’s approvals, such as the accuracy rate, the rate at which human reviewers catch errors that Copilot missed, and the impact on review speed.

Currently, there are no built-in tools for this kind of tracking, so teams will need to develop them to justify the granting of approval authority to Copilot.