GitHub Release Notes

The Copilot usage metrics REST API now reports repository-level activity. Two new endpoints return a daily, per-repository breakdown of pull request activity for Copilot coding agent and Copilot code review. They do this for both enterprise and organization reports.

What’s new

Two new endpoints return a per-repository report for a single day:

GET /enterprises/{enterprise}/copilot/metrics/reports/repos-1-day?day=YYYY-MM-DD

GET /orgs/{org}/copilot/metrics/reports/repos-1-day?day=YYYY-MM-DD

Each response returns the following activity:

• Pull requests created and merged by Copilot coding agent.
• Pull requests reviewed by Copilot code review, with suggestion counts broken down by comment type.

Why this matters

Until now, Copilot usage metrics stopped at the organization and user level. Repository-level reporting lets you see exactly where Copilot coding agent and Copilot code review are driving pull request activity across your codebase. This is the foundation for repository insights and AI-readiness reporting, so you can target enablement at the repositories that stand to benefit most.

Important notes

Enterprise owners and billing managers, organization owners, and anyone with a custom organization or enterprise role that grants the View Copilot Metrics permission can access these reports. The Copilot usage metrics policy must be enabled to support this functionality.

Visit the Copilot usage metrics API documentation to get started.

The post Repository-level GitHub Copilot usage metrics generally available appeared first on The GitHub Blog.

Original source

What’s new

The Copilot usage metrics API now reports the GitHub Copilot app usage in the enterprise and organization 1-day and 28-day reports. This gives enterprise and organization admins visibility into the app’s activity alongside the IDE, chat, code review, and coding agent metrics they already retrieve.

The enterprise and organization reports now include two new fields:

• daily_active_copilot_app_users: The number of distinct users active in the Copilot app on a given day.
• totals_by_copilot_app: A dedicated GitHub Copilot app section reporting session_count, request_count, prompt_count, and a token_usage breakdown (i.e., output_tokens_sum, prompt_tokens_sum, and avg_tokens_per_request).

Why this matters

The GitHub Copilot app activity was not previously represented in usage reporting. With these fields, enterprise and organization admins can see how broadly the app is being adopted (e.g., distinct active users, session and request volume, and token consumption) in the same API they already use for the rest of their Copilot usage metrics.

Important notes

• These fields appear in the enterprise and organization 1-day and 28-day reports.
• The GitHub Copilot app usage is reported in its own totals_by_copilot_app section and is kept separate from the generic feature, model, and language totals, as well as from lines-of-code metrics.
• Enterprises or organizations with no GitHub Copilot app activity report null for both daily_active_copilot_app_users and totals_by_copilot_app, so existing integrations are unaffected.
• Visit the Copilot usage metrics API documentation to get started.

The post GitHub Copilot app now available in the usage metrics API appeared first on The GitHub Blog.

Original source

Copilot code review now utilizes a firewall, custom setup steps, and independent runner configurations. It now reads custom instructions from the head branch to allow for easy testing and validation of custom instructions. These changes give administrators and developers more control over how Copilot code review runs in their environment.

Expanding custom instructions, now easier to validate

📝 Custom instructions now read from the head branch

Custom instructions are now read from the head branch of the pull request instead of the base branch. This includes copilot-instructions.md, *.instructions.md, agent skills, and AGENTS.md. This means you can iterate on and test custom instructions in a feature branch without needing to merge them first.

📄 Expanded custom instructions file support

Copilot code review now reads REVIEW.md, GEMINI.md, and CLAUDE.md files from your repository, so your customizations are understood regardless of where they live. If your team already maintains review guidelines or model-specific instructions in these files, Copilot code review will automatically pick them up and incorporate them into its review process.

🔧 Custom setup steps

You can now configure the environment available to Copilot code review during runtime using a copilot-code-review.yml file in your .github/workflows/ directory. This lets you install dependencies, configure runners on the repository level independently of Copilot cloud agent, set up tooling, or run any preparation steps that Copilot code review needs to produce the reviews you desire for your repository.

Add a copilot-code-review.yml file to your repository to define setup steps specific to Copilot code review.

If no copilot-code-review.yml file exists, Copilot code review will fall back to your existing copilot-setup-steps.yml file if one is present.

To learn more about how to set up a copilot-code-review.yml file, see our documentation on setting the Copilot code review environment.

🛡️ Firewall support

Copilot code review now runs behind a firewall by default, restricting network access during a review. The firewall is configurable separately from Copilot cloud agent in repository and organization settings, giving you independent control over each agent’s network access.

The firewall is enabled by default for all repositories.

To configure this setting in your repository, navigate to your repository settings, then go to Copilot → Internet access.

⚠️ Self-hosted runners do not currently support the firewall. If you have self-hosted runners configured for Copilot code review, your reviews will continue to run as usual without the firewall.

⚙️ Organization runner configuration updates for Copilot code review

Copilot code review and Copilot cloud agent previously shared a single runner configuration at the organization level. That configuration is now split into two separate sections on the Runner type settings page in your organization settings, allowing you to independently choose different runner types for each agent.

To update your configuration, navigate to your organization settings, then go to Copilot → Runner type.

The post Copilot code review: Customization and configurability improvements appeared first on The GitHub Blog.

Original source

You can now select Fix with Copilot directly from Copilot code review pull request comments in GitHub Mobile. The button is available both on the pull request’s main view and on individual review comments, giving you multilpe ways to start a Copilot-assisted fix.

Copilot cloud agent helps you respond to review feedback without requiring you to manually compose a prompt, making it easier to get started in one tap. Whether you’re away from your desk or reviewing changes on the go, this new entry point helps you address comments more quickly and keep pull requests moving forward.

This is now available on the latest production build of GitHub Mobile on iOS and Android.

Join the discussion within GitHub Community.

The post GitHub Mobile: Fix pull request comments with Copilot cloud agent appeared first on The GitHub Blog.

Original source

Added

• Add --plugin, --mcp, and --skill flags for plugin mutations
• Add skill removal support to copilot plugins remove --skill

Improved

• Reveal full file paths when expanding compact editing rows
• Make the plan-approval menu deterministic across models
• Keep /add-dir directories visible in the agent context across turns

Fixed

• Wrap ask-user and elicitation inputs in the split-pane chat view
• Modified vim keys (Ctrl+K, uppercase J/K) no longer move the selection in tool-permission prompts and other text-input select menus; only unmodified j/k, the arrow keys, and Ctrl+P/Ctrl+N navigate.
• /terminal-setup now refuses to modify a VS Code keybindings.json that contains a JSON syntax error (instead of rewriting it and reporting success), matching its documented invalid-JSON handling.

Original source

The filter bar in GitHub Projects views now supports advanced search, so you can build the exact view you need with logical AND and OR instead of maintaining a separate view for every question. Just type an expression using OR, AND in the filter bar of any project view.

Other improvements

You can now filter pull request items in your projects views by their review state using the new reviews: search filter. This is backed by the Reviewers field that tracks who’s been requested to review and the latest review submitted by each person.

We’ve implemented a new 90-day retention policy for deployment statuses. Statuses older than 90 days are automatically deleted and no longer appear in the REST or GraphQL API. A deployment’s current state is unaffected.

Share your feedback in the GitHub Community.

The post Advanced search for Projects is generally available appeared first on The GitHub Blog.

Original source

Repository admins can now archive pull requests to remove them from public view without permanently deleting them.

When a pull request is archived, it is closed and locked. Pull requests can be archived in bulk or on an individual basis. Archived pull requests are only visible to repository admins, and non-admin visitors to the URL receive a 404 response. If you unarchive a pull request, it becomes visible again and remains closed and locked.

This gives you a moderation-focused option for handling spammy or abusive pull requests, supporting legal or policy requirements where deletion is not preferred, and preserving historical context for administrators.

You can also find archived pull requests using the is:archived filter to support triage workflows.

We’d love to hear your feedback. Drop any questions or comments within our Community discussion.

The post Repository admins can archive pull requests appeared first on The GitHub Blog.

Original source

GitHub Enterprise Cloud admins can now use the following REST API endpoints to programmatically manage Visual Studio Subscription (VSS) assignments:

GET /enterprises/{enterprise}/visual-studio-subscriptions: Returns all VSS assignments for an enterprise, including whether each assignment has been matched to a GitHub user.

PUT /enterprises/{enterprise}/visual-studio-subscriptions: Maps a VSS UPN to a GitHub handle, enabling bulk programmatic matching.

DELETE /enterprises/{enterprise}/visual-studio-subscriptions/{visual_studio_subscription_id}: Removes a manual match between a Visual Studio subscription and a GitHub user, allowing admins to correct mistaken assignments or programmatically rematch subscriptions.

These endpoints are especially useful for organizations where VSS UPN formats do not align with SCIM identities, a scenario that prevents automatic matching and previously required tedious manual resolution in the UI. Admins can now supply a UPN-to-GitHub-handle crosswalk and script bulk-matching operations.

The post REST API endpoints for Visual Studio Subscription management appeared first on The GitHub Blog.

Original source

You can now build and test your Apple applications against Xcode 27 on GitHub-hosted macOS runners. This is now available in public preview.

With early access to the latest Xcode toolchain and Apple SDKs, you can validate your apps against the newest tools, catch compatibility issues sooner, and keep your CI/CD pipelines current.

A new support model for macOS images

With this release, we are moving to a new support model for our macOS images. Each image is based on a major Xcode version rather than the underlying operating system, and we will support one major Xcode version per image. This makes it easier to target the exact toolchain your project needs and to know what each runner provides.

Get started today

To use Xcode 27 in your GitHub Actions workflows, update the runs-on: value to one of the supported labels.

The following labels are supported for the new image:

• xcode-27
• xcode-27-xlarge

Limitations

This image is only available on our arm64 macOS runners and is not supported on Intel runners. The runner image includes different tools and tool versions than earlier images. To view the full list of installed software or report an issue, visit the runner-images repository.

The post Xcode 27 runner image now in public preview appeared first on The GitHub Blog.

Original source

2026-07-16

copilot -p --autopilot no longer hangs when a background shell or agent outlives the turn; it now honors the COPILOT_TASK_WAIT_TIMEOUT_SECONDS timeout the same way plain -p does.

Reopening the /subagents model picker keeps each agent's reasoning effort and context tier

Refresh memory context after 30 minutes in long-lived sessions

Keep MCP tool lists up to date when servers change

Avoid leaving long-running background git processes after exit

Add a configurable maximum for Ctrl+R command history

On startup, an invalid settings.json now shows a warning identifying the offending value instead of silently ignoring your settings

/terminal-setup no longer skips setup on terminals without real kitty keyboard support

Add /voice devices to choose and persist the microphone for voice mode

Limit which built-in agents are available to tasks and subagents

Add canvas support in the CLI for extension-driven interactions

Enforce the sandbox filesystem policy on LSP file reads and rename edits

Allow empty owner and author emails in marketplace metadata

Keep all MCP Server Type options visible on short terminals

Mark disabled skills in copilot skill list and its JSON output

Plan mode now hard-blocks built-in tool calls that would modify the workspace, so the agent can no longer edit files or run mutating shell commands while planning (built-in mutators like opening a pull request are blocked; MCP and external tools are still allowed)

Improve /chronicle cost-tips recommendations with richer cost profiles

Highlight standalone hex colors inline in Markdown

Persist GitHub MCP toolset/tool config via settings.json (githubMcpToolsets, githubMcpTools, etc.)

Add plugins marketplace subcommands to list, add, and remove plugin marketplaces

Persist sidebar sessions across restarts

Add plugins marketplace browse and update commands

Split /worktree and /move: /worktree now creates a new worktree and leaves your uncommitted changes behind, while the new /move carries them into the new worktree

Add local and cloud cost profiles to /chronicle cost-tips

Switching to autopilot mid-turn now auto-answers questions asked during that same turn

Custom agents that request a shell tool by alias now also receive the matching read, list, and stop shell tools

Slash commands and their autocomplete now match regardless of case (e.g. /SESSION works like /session)

Show repo-enabled plugins in /plugin list and skill pickers

Press ? twice to dismiss quick help and start a prompt with a literal ?

Shell completions suggest positional-argument choices

Show the /app launch message and download link immediately on Linux

Validate --max-autopilot-continues rejects NaN, negative, and fractional values

Honor NO_COLOR in the CLI even when chalk cached a color level

Apply updated session options (shell flags, streaming, custom agent defaults) immediately after /settings changes

Announce the focused /model row for screen readers

Announce the focused picker row to screen readers

Show selected custom agents once in /agent and keep their source label when the file name differs from the display name

Clear the /model pricing banner when no models match

Keep /share file session and /share html session from using the full-session selector as an output path

Honor --context in fresh interactive sessions

Fixed the model picker changing a hidden model's reasoning effort or context window when the search matched no results, and hid the inert key hints shown in that empty state

Display plugin root skills as /plugin instead of /plugin:plugin

Keep valid hooks in a config file when one hook entry is malformed

Denying write(path) now blocks only the specified path

Using --add-github-mcp-tool "*" now enables all GitHub MCP tools

Render empty untracked files without a phantom added line

Show clean failure messages when copilot skill add fails

Press Enter on a blank settings array item to show an error instead of saving an empty value

Press Enter once to toggle booleans with a registered default in /settings

Declining folder trust in /cwd keeps your live session open and returns to the previous folder

Show a warning when a workspace MCP config is malformed or cannot be loaded

Make bare copilot mcp and copilot skill print help and exit 0, matching copilot plugin. Consistent with plugin, the implicit help form is not supported for these groups; use copilot mcp --help (or copilot skill --help) instead.

Show malformed allowed_models.txt policy errors cleanly in -p mode

Resume synced sessions by name without a false multiple matches error

Show an error when --name is used with --session-id for an existing session

Show --plugin-dir plugins in copilot plugin list

Keep backgrounded sessions alive when you switch away from them

Link bare #number GitHub refs in -p --stream off output

Show the startup banner only on the first launch when set to once

Allow copilot update and /update to accept stable as a channel

Surface --plugin-dir warnings in the terminal

Surface the real load error for malformed custom agents

Reject --continue when used with --resume

Prompt mode now exits non-zero when a --share or --share-gist export fails

Server mode reconnects OAuth MCP servers from cached tokens

Keep stored Git credential helpers available for marketplace plugin installs

The /model picker shows the Auto model description as markdown with a clickable Learn More link

Keep sessions tied to their working directory across prompts, restarts, and workspace tools

Always offer a custom answer in ask_user choice prompts

Lower the default maximum sub-agent nesting depth from 6 to 4 to curb runaway recursive sub-agent delegation. Usage-based billing users can still adjust subagents.maxDepth (up to 128).

Add a pinned prompts setting in /settings to control prompt pinning

Add Repo and Repo (local) scope tabs to the /settings dashboard

Interactive shell commands now fail with a retryable "reconfiguring" message instead of an "unknown shellManager handle" error after the shell manager is disposed, and a detached command's completion notification is no longer lost when the shell context is reconfigured while a read is in progress

Reject custom-agent names that would create hidden files

Reject malformed --allow-tool and --deny-tool patterns with an error message

Show retained shell output in /tasks Shell Details for finished tasks

Remove duplicate Error: prefixes from plugin command failures

Shell completions stop suggesting subcommands as flag values

Show singular message counts in /usage activity graph

Keep /cd from switching to files or inaccessible directories

Dismissing the quick-help overlay with ? no longer leaves a stray ? in the prompt

--sandbox and --no-sandbox now show their "ignored" warning during interactive startup when the sandbox feature is unavailable (previously it was only visible in non-interactive mode)

Show the full command with its arguments (not just the wrapper) in the /mcp server detail view

Hide the inert navigate and view-log hints in the empty /lsp logs (LSP Services) panel

Exit non-interactive prompt runs with a failure code when a prompt is blocked before responding

Show the Auto discount in the redesigned inline model picker

New sessions start in the default directory instead of the active session's cwd

Fish completion only offers enum values for closed-choice flags

Use targeted validation commands and lighter install guidance by default

Use ctrl+x → x to close a session and ctrl+x → h to hide the split sidebar

Original source

This week, we’re rolling out several improvements to secret scanning and public monitoring:

• Resend is now a GitHub secret scanning partner.
• Secret scanning now detects new secret types from APIclub and Resend.
• Secret scanning now blocks VolcEngine secrets with push protection by default.
• The secret_scanning_alert webhook now includes a secret_category field (i.e., default or generic) so you can distinguish between specific and generic types.
• The public monitoring alert list now surfaces insight cards at the top of the page, including a breakdown of associated leaks by attribution, your enterprise member count, and your verified domains.

GitHub secret scanning partnership program

GitHub secret scanning protects users by searching repositories for known types of secrets such as tokens and private keys. By identifying and flagging these secrets, our scans help prevent data leaks and fraud.

We have partnered with Resend to scan for their tokens to help secure the development community. GitHub will forward any exposed secrets found in public repositories to Resend, who will take appropriate action, including revoking the secret or notifying respect admins.

Learn more about the secret scanning partnership program. If you are a secret issuer interested in partnering with us, you can get started by opening a ticket with GitHub support.

Detectors added

Secret scanning now automatically detects the following new secret types in your repositories.

Provider

Secret type

• APIclub
• apiclub_api_key
• Resend
• resend_api_key

Partner secrets are automatically reported to the secret issuer when found in public repositories through the secret scanning partnership program. User secrets generate secret scanning alerts when found in public or private repositories.

Push protection defaults expanded

The following detector is now included in push protection by default. Repositories with secret scanning enabled, including free public repositories, will automatically block commits containing this secret.

Provider

Secret type

• VolcEngine
• volcengine_ark_api_key

Distinguish secret categories in the webhook payload

The secret_scanning_alert webhook payload now includes a secret_category field, so you can tell default and generic detections apart without maintaining your own mapping of secret types:

• default: provider patterns plus your custom patterns.
• generic: generic patterns and AI-detected secrets.

This mirrors the Default and Generic results views in secret scanning, making it easier to filter, route, and report on alerts in your own integrations and automation.

New insights on the public monitoring alert list

The public monitoring alert list now shows insight cards at the top of the page, giving your security team at-a-glance context before digging into individual alerts:

• Associated leaks by attribution: A breakdown of alert counts by how each leak was attributed to your enterprise: member activity (a commit authored by an enterprise member) and verified domain (a committer email on one of your verified domains).
• Enterprise members: The total number of members in your enterprise, matching the count of members in your enterprise People tab.
• Verified domains: The verified domains associated with your enterprise, including both enterprise-owned and organization-owned domains.

Together, these cards help you gauge the scope of exposure and understand how leaks are reaching your enterprise, all without leaving the alert list.

Learn more

Learn more about secret scanning, public monitoring, and the full list of supported secrets in our documentation. Let us know what you think in the community discussion.

The post Improvements to secret scanning and public monitoring appeared first on The GitHub Blog.

Original source

Highlights

Here’s what’s new with GitHub Copilot in Visual Studio 2026. Check the Insiders channel for the latest:

• Copilot usage tracking and alerts: The refreshed Copilot Usage window reflects GitHub Copilot’s usage-based billing model with real-time updates. In addition, proactive alerts let you know when you’re approaching your limit, when you’ve hit it, and when overages activate. Open it from Copilot badge menu > Copilot Usage and tune the warning threshold in settings to decide how early you get the notification.

• Trust validation for MCP servers: Visual Studio now compares an MCP server’s configuration and asset fingerprint against a trusted baseline at startup. If anything has changed, a trust dialog asks you to review and approve the change before the server runs. This feature is on by default and lives under Tools > Options > GitHub > Copilot > Copilot Chat > Show trust dialog before running tools from an updated MCP server.

• GitHub Copilot modernization agent for C++ is generally available: The MSVC upgrade scenarios for the modernization agent have graduated from preview. Run it in Automated mode for end-to-end upgrades or in Guided mode to review the assessment, plan, and execution before each step. Right-click a project in Solution Explorer and select Modernize or use @Modernize in Copilot Chat.

• Long-distance next edit suggestions: Copilot’s next edit suggestions can now predict and propose follow-up edits anywhere in the active file, not just near your cursor. Turn it on under Tools > Options > Text Editor > Inline Suggestions by selecting Enable extended range suggestions.

• Add pull requests to Copilot Chat: Right-click a pull request in the Git Repository window and select Add to Copilot Chat. Copilot will then pick up the pull request description, changed files, and comments as context. You can also reference a pull request inline by typing # followed by the pull request ID. This functionality requires View pull requests for a Git repository under Preview Features.

• Review and approve pull requests in the IDE: The new in-IDE pull request review experience pairs naturally with Add to Copilot Chat. Browse, comment, approve, and complete pull requests from GitHub or Azure DevOps without leaving Visual Studio, then pull any pull request into Copilot Chat when you want help triaging or summarizing.

This update is available to users on all GitHub Copilot plans, including Copilot Free, Student, Pro, Pro+, Max, Business, and Enterprise.

Download Visual Studio 2026 to experience all the new Copilot features today. To learn more about what’s new, check out the Visual Studio blog and release notes.

What’s next for Copilot in Visual Studio

Stay up to date on the latest Copilot features by following the Visual Studio blog, where you’ll find roadmap updates and opportunities to share feedback.

The post GitHub Copilot in Visual Studio — June update appeared first on The GitHub Blog.

Original source

Added

• Add /voice devices to choose and persist the microphone for voice mode
• Limit which built-in agents are available to tasks and subagents
• Add canvas support in the CLI for extension-driven interactions

Improved

• Improve /chronicle cost-tips recommendations with richer cost profiles
• Highlight standalone hex colors inline in Markdown

Fixed

• Enforce the sandbox filesystem policy on LSP file reads and rename edits
• Allow empty owner and author emails in marketplace metadata
• Keep all MCP Server Type options visible on short terminals
• Mark disabled skills in copilot skill list and its JSON output
• Plan mode now hard-blocks built-in tool calls that would modify the workspace, so the agent can no longer edit files or run mutating shell commands while planning (built-in mutators like opening a pull request are blocked; MCP and external tools are still allowed)

Original source