GitHub Updates & Release Notes

The Copilot usage metrics REST API now reports repository-level activity. Two new endpoints return a daily, per-repository breakdown of pull request activity for Copilot coding agent and Copilot code review. They do this for both enterprise and organization reports.

What’s new

Two new endpoints return a per-repository report for a single day:

GET /enterprises/{enterprise}/copilot/metrics/reports/repos-1-day?day=YYYY-MM-DD

GET /orgs/{org}/copilot/metrics/reports/repos-1-day?day=YYYY-MM-DD

Each response returns the following activity:

• Pull requests created and merged by Copilot coding agent.
• Pull requests reviewed by Copilot code review, with suggestion counts broken down by comment type.

Why this matters

Until now, Copilot usage metrics stopped at the organization and user level. Repository-level reporting lets you see exactly where Copilot coding agent and Copilot code review are driving pull request activity across your codebase. This is the foundation for repository insights and AI-readiness reporting, so you can target enablement at the repositories that stand to benefit most.

Important notes

Enterprise owners and billing managers, organization owners, and anyone with a custom organization or enterprise role that grants the View Copilot Metrics permission can access these reports. The Copilot usage metrics policy must be enabled to support this functionality.

Visit the Copilot usage metrics API documentation to get started.

The post Repository-level GitHub Copilot usage metrics generally available appeared first on The GitHub Blog.

What’s new

The Copilot usage metrics API now reports the GitHub Copilot app usage in the enterprise and organization 1-day and 28-day reports. This gives enterprise and organization admins visibility into the app’s activity alongside the IDE, chat, code review, and coding agent metrics they already retrieve.

The enterprise and organization reports now include two new fields:

• daily_active_copilot_app_users: The number of distinct users active in the Copilot app on a given day.
• totals_by_copilot_app: A dedicated GitHub Copilot app section reporting session_count, request_count, prompt_count, and a token_usage breakdown (i.e., output_tokens_sum, prompt_tokens_sum, and avg_tokens_per_request).

Why this matters

The GitHub Copilot app activity was not previously represented in usage reporting. With these fields, enterprise and organization admins can see how broadly the app is being adopted (e.g., distinct active users, session and request volume, and token consumption) in the same API they already use for the rest of their Copilot usage metrics.

Important notes

• These fields appear in the enterprise and organization 1-day and 28-day reports.
• The GitHub Copilot app usage is reported in its own totals_by_copilot_app section and is kept separate from the generic feature, model, and language totals, as well as from lines-of-code metrics.
• Enterprises or organizations with no GitHub Copilot app activity report null for both daily_active_copilot_app_users and totals_by_copilot_app, so existing integrations are unaffected.
• Visit the Copilot usage metrics API documentation to get started.

The post GitHub Copilot app now available in the usage metrics API appeared first on The GitHub Blog.

Copilot code review now utilizes a firewall, custom setup steps, and independent runner configurations. It now reads custom instructions from the head branch to allow for easy testing and validation of custom instructions. These changes give administrators and developers more control over how Copilot code review runs in their environment.

Expanding custom instructions, now easier to validate

📝 Custom instructions now read from the head branch

Custom instructions are now read from the head branch of the pull request instead of the base branch. This includes copilot-instructions.md, *.instructions.md, agent skills, and AGENTS.md. This means you can iterate on and test custom instructions in a feature branch without needing to merge them first.

📄 Expanded custom instructions file support

Copilot code review now reads REVIEW.md, GEMINI.md, and CLAUDE.md files from your repository, so your customizations are understood regardless of where they live. If your team already maintains review guidelines or model-specific instructions in these files, Copilot code review will automatically pick them up and incorporate them into its review process.

🔧 Custom setup steps

You can now configure the environment available to Copilot code review during runtime using a copilot-code-review.yml file in your .github/workflows/ directory. This lets you install dependencies, configure runners on the repository level independently of Copilot cloud agent, set up tooling, or run any preparation steps that Copilot code review needs to produce the reviews you desire for your repository.

Add a copilot-code-review.yml file to your repository to define setup steps specific to Copilot code review.

If no copilot-code-review.yml file exists, Copilot code review will fall back to your existing copilot-setup-steps.yml file if one is present.

To learn more about how to set up a copilot-code-review.yml file, see our documentation on setting the Copilot code review environment.

🛡️ Firewall support

Copilot code review now runs behind a firewall by default, restricting network access during a review. The firewall is configurable separately from Copilot cloud agent in repository and organization settings, giving you independent control over each agent’s network access.

The firewall is enabled by default for all repositories.

To configure this setting in your repository, navigate to your repository settings, then go to Copilot → Internet access.

⚠️ Self-hosted runners do not currently support the firewall. If you have self-hosted runners configured for Copilot code review, your reviews will continue to run as usual without the firewall.

⚙️ Organization runner configuration updates for Copilot code review

Copilot code review and Copilot cloud agent previously shared a single runner configuration at the organization level. That configuration is now split into two separate sections on the Runner type settings page in your organization settings, allowing you to independently choose different runner types for each agent.

To update your configuration, navigate to your organization settings, then go to Copilot → Runner type.

The post Copilot code review: Customization and configurability improvements appeared first on The GitHub Blog.

You can now select Fix with Copilot directly from Copilot code review pull request comments in GitHub Mobile. The button is available both on the pull request’s main view and on individual review comments, giving you multilpe ways to start a Copilot-assisted fix.

Copilot cloud agent helps you respond to review feedback without requiring you to manually compose a prompt, making it easier to get started in one tap. Whether you’re away from your desk or reviewing changes on the go, this new entry point helps you address comments more quickly and keep pull requests moving forward.

This is now available on the latest production build of GitHub Mobile on iOS and Android.

Join the discussion within GitHub Community.

The post GitHub Mobile: Fix pull request comments with Copilot cloud agent appeared first on The GitHub Blog.

The filter bar in GitHub Projects views now supports advanced search, so you can build the exact view you need with logical AND and OR instead of maintaining a separate view for every question. Just type an expression using OR, AND in the filter bar of any project view.

Other improvements

You can now filter pull request items in your projects views by their review state using the new reviews: search filter. This is backed by the Reviewers field that tracks who’s been requested to review and the latest review submitted by each person.

We’ve implemented a new 90-day retention policy for deployment statuses. Statuses older than 90 days are automatically deleted and no longer appear in the REST or GraphQL API. A deployment’s current state is unaffected.

Share your feedback in the GitHub Community.

The post Advanced search for Projects is generally available appeared first on The GitHub Blog.

Repository admins can now archive pull requests to remove them from public view without permanently deleting them.

When a pull request is archived, it is closed and locked. Pull requests can be archived in bulk or on an individual basis. Archived pull requests are only visible to repository admins, and non-admin visitors to the URL receive a 404 response. If you unarchive a pull request, it becomes visible again and remains closed and locked.

This gives you a moderation-focused option for handling spammy or abusive pull requests, supporting legal or policy requirements where deletion is not preferred, and preserving historical context for administrators.

You can also find archived pull requests using the is:archived filter to support triage workflows.

We’d love to hear your feedback. Drop any questions or comments within our Community discussion.

The post Repository admins can archive pull requests appeared first on The GitHub Blog.

GitHub Enterprise Cloud admins can now use the following REST API endpoints to programmatically manage Visual Studio Subscription (VSS) assignments:

GET /enterprises/{enterprise}/visual-studio-subscriptions: Returns all VSS assignments for an enterprise, including whether each assignment has been matched to a GitHub user.

PUT /enterprises/{enterprise}/visual-studio-subscriptions: Maps a VSS UPN to a GitHub handle, enabling bulk programmatic matching.

DELETE /enterprises/{enterprise}/visual-studio-subscriptions/{visual_studio_subscription_id}: Removes a manual match between a Visual Studio subscription and a GitHub user, allowing admins to correct mistaken assignments or programmatically rematch subscriptions.

These endpoints are especially useful for organizations where VSS UPN formats do not align with SCIM identities, a scenario that prevents automatic matching and previously required tedious manual resolution in the UI. Admins can now supply a UPN-to-GitHub-handle crosswalk and script bulk-matching operations.

The post REST API endpoints for Visual Studio Subscription management appeared first on The GitHub Blog.

You can now build and test your Apple applications against Xcode 27 on GitHub-hosted macOS runners. This is now available in public preview.

With early access to the latest Xcode toolchain and Apple SDKs, you can validate your apps against the newest tools, catch compatibility issues sooner, and keep your CI/CD pipelines current.

A new support model for macOS images

With this release, we are moving to a new support model for our macOS images. Each image is based on a major Xcode version rather than the underlying operating system, and we will support one major Xcode version per image. This makes it easier to target the exact toolchain your project needs and to know what each runner provides.

Get started today

To use Xcode 27 in your GitHub Actions workflows, update the runs-on: value to one of the supported labels.

The following labels are supported for the new image:

• xcode-27
• xcode-27-xlarge

Limitations

This image is only available on our arm64 macOS runners and is not supported on Intel runners. The runner image includes different tools and tool versions than earlier images. To view the full list of installed software or report an issue, visit the runner-images repository.

The post Xcode 27 runner image now in public preview appeared first on The GitHub Blog.

This week, we’re rolling out several improvements to secret scanning and public monitoring:

• Resend is now a GitHub secret scanning partner.
• Secret scanning now detects new secret types from APIclub and Resend.
• Secret scanning now blocks VolcEngine secrets with push protection by default.
• The secret_scanning_alert webhook now includes a secret_category field (i.e., default or generic) so you can distinguish between specific and generic types.
• The public monitoring alert list now surfaces insight cards at the top of the page, including a breakdown of associated leaks by attribution, your enterprise member count, and your verified domains.

GitHub secret scanning partnership program

GitHub secret scanning protects users by searching repositories for known types of secrets such as tokens and private keys. By identifying and flagging these secrets, our scans help prevent data leaks and fraud.

We have partnered with Resend to scan for their tokens to help secure the development community. GitHub will forward any exposed secrets found in public repositories to Resend, who will take appropriate action, including revoking the secret or notifying respect admins.

Learn more about the secret scanning partnership program. If you are a secret issuer interested in partnering with us, you can get started by opening a ticket with GitHub support.

Detectors added

Secret scanning now automatically detects the following new secret types in your repositories.

Provider

Secret type

• APIclub
• apiclub_api_key
• Resend
• resend_api_key

Partner secrets are automatically reported to the secret issuer when found in public repositories through the secret scanning partnership program. User secrets generate secret scanning alerts when found in public or private repositories.

Push protection defaults expanded

The following detector is now included in push protection by default. Repositories with secret scanning enabled, including free public repositories, will automatically block commits containing this secret.

Provider

Secret type

• VolcEngine
• volcengine_ark_api_key

Distinguish secret categories in the webhook payload

The secret_scanning_alert webhook payload now includes a secret_category field, so you can tell default and generic detections apart without maintaining your own mapping of secret types:

• default: provider patterns plus your custom patterns.
• generic: generic patterns and AI-detected secrets.

This mirrors the Default and Generic results views in secret scanning, making it easier to filter, route, and report on alerts in your own integrations and automation.

New insights on the public monitoring alert list

The public monitoring alert list now shows insight cards at the top of the page, giving your security team at-a-glance context before digging into individual alerts:

• Associated leaks by attribution: A breakdown of alert counts by how each leak was attributed to your enterprise: member activity (a commit authored by an enterprise member) and verified domain (a committer email on one of your verified domains).
• Enterprise members: The total number of members in your enterprise, matching the count of members in your enterprise People tab.
• Verified domains: The verified domains associated with your enterprise, including both enterprise-owned and organization-owned domains.

Together, these cards help you gauge the scope of exposure and understand how leaks are reaching your enterprise, all without leaving the alert list.

Learn more

Learn more about secret scanning, public monitoring, and the full list of supported secrets in our documentation. Let us know what you think in the community discussion.

The post Improvements to secret scanning and public monitoring appeared first on The GitHub Blog.

Highlights

Here’s what’s new with GitHub Copilot in Visual Studio 2026. Check the Insiders channel for the latest:

• Copilot usage tracking and alerts: The refreshed Copilot Usage window reflects GitHub Copilot’s usage-based billing model with real-time updates. In addition, proactive alerts let you know when you’re approaching your limit, when you’ve hit it, and when overages activate. Open it from Copilot badge menu > Copilot Usage and tune the warning threshold in settings to decide how early you get the notification.

• Trust validation for MCP servers: Visual Studio now compares an MCP server’s configuration and asset fingerprint against a trusted baseline at startup. If anything has changed, a trust dialog asks you to review and approve the change before the server runs. This feature is on by default and lives under Tools > Options > GitHub > Copilot > Copilot Chat > Show trust dialog before running tools from an updated MCP server.

• GitHub Copilot modernization agent for C++ is generally available: The MSVC upgrade scenarios for the modernization agent have graduated from preview. Run it in Automated mode for end-to-end upgrades or in Guided mode to review the assessment, plan, and execution before each step. Right-click a project in Solution Explorer and select Modernize or use @Modernize in Copilot Chat.

• Long-distance next edit suggestions: Copilot’s next edit suggestions can now predict and propose follow-up edits anywhere in the active file, not just near your cursor. Turn it on under Tools > Options > Text Editor > Inline Suggestions by selecting Enable extended range suggestions.

• Add pull requests to Copilot Chat: Right-click a pull request in the Git Repository window and select Add to Copilot Chat. Copilot will then pick up the pull request description, changed files, and comments as context. You can also reference a pull request inline by typing # followed by the pull request ID. This functionality requires View pull requests for a Git repository under Preview Features.

• Review and approve pull requests in the IDE: The new in-IDE pull request review experience pairs naturally with Add to Copilot Chat. Browse, comment, approve, and complete pull requests from GitHub or Azure DevOps without leaving Visual Studio, then pull any pull request into Copilot Chat when you want help triaging or summarizing.

This update is available to users on all GitHub Copilot plans, including Copilot Free, Student, Pro, Pro+, Max, Business, and Enterprise.

Download Visual Studio 2026 to experience all the new Copilot features today. To learn more about what’s new, check out the Visual Studio blog and release notes.

What’s next for Copilot in Visual Studio

Stay up to date on the latest Copilot features by following the Visual Studio blog, where you’ll find roadmap updates and opportunities to share feedback.

The post GitHub Copilot in Visual Studio — June update appeared first on The GitHub Blog.

This update brings major advances in customization and model provider flexibility to all tiers of GitHub Copilot for JetBrains IDEs. With richer plugin and provider experiences, improved conversational interactions, and stronger reliability, teams can more confidently tailor Copilot to how they build software.

What’s new

Bring your own key custom endpoint support

We’ve expanded bring your own key support with custom endpoints. You can now configure OpenAI-compatible custom endpoints with API keys to use your own models.

Expanded customizations with plugin management

GitHub Copilot for JetBrains now includes a more complete plugin management experience in customizations. You can browse and install plugins through the marketplace or from the source repository.

This makes it easier to shape Copilot around team-specific workflows without jumping between disconnected setup surfaces.

Claude agent provider customizations support

Customizations now support Claude agent provider, allowing you to set up custom agents, skills, and instructions. Available for GitHub Copilot Pro and higher plans in public preview.

Local sandboxing support

This release adds support for local sandboxing, including new sandbox settings and configuration flows in the JetBrains plugin. This feature is in public preview. For more information, see About cloud and local sandboxes.

Built-in debugger skill for Copilot CLI

This release adds a built-in debugger skill for Copilot CLI sessions, enabling agent-driven debugging workflows directly in your development environment. It helps you investigate issues step by step with guided debugging support. This feature is in public preview.

User experience enhancements

This version also improves usability across chat, model selection, customization views, and CLI sessions.

• Improved model picker controls in chat and inline chat
• Improved UI clarity for custom agents, customizations, and provider settings
• Improved authentication UX messaging
• Added message re-edit support in inline and CLI experiences for faster prompt iteration and follow-up requests

Quality improvements

We’ve improved reliability and stability across authentication recovery, account switching, provider and session persistence, and editor interaction paths. These fixes reduce friction in long-running sessions and make Copilot behavior more consistent when switching modes, providers, or work contexts.

Changed

We’ve adjusted Copilot CLI provider policy handling for CLI-as-default scenarios. Disabling Copilot CLI by policy no longer affects Copilot CLI provider in JetBrains IDEs.

Try it out

We encourage you to try out the latest version of the GitHub Copilot plugin and share your feedback. Your input is invaluable in helping us refine and improve the product.

Share your feedback

Your feedback drives improvements. We’d love to hear about your experience in the following channels:

• In-product feedback: Use the feedback options within your IDE.
• Feedback repository: Share your thoughts in the GitHub Copilot for JetBrains IDEs issues.

The post GitHub Copilot for JetBrains expands BYOK capabilities appeared first on The GitHub Blog.

GitHub code scanning now surfaces AI-powered security detections directly on pull requests, expanding vulnerability coverage to languages and frameworks not currently supported by CodeQL. These detections help teams identify and address potential issues in parts of the codebase that previously had no native scanning coverage, all before code is merged.

What’s included

Broader language coverage: AI-powered detections extend code scanning to languages and frameworks beyond those supported by CodeQL’s built-in analysis, reducing blind spots across your codebase.

Native pull request integration: Findings appear directly in pull requests, so developers can review and address issues as part of their existing workflow before merging code. Alerts generated using AI will be labeled with AI so you can easily distinguish them from CodeQL results.

Easy to enable: Once allowed at the enterprise level, you can enable AI security detections for any repository or organization that have GitHub code security and CodeQL default setup turned on.

How it works

AI security detections are powered by GitHub’s AI detection engine and automatically run when a pull request is opened or updated. Results appear as the engine returns them. There’s no need to wait for all analysis sources to complete. These findings are informational and won’t block pull request merges.

To use the feature, AI security detections must be allowed by your Enterprise policy and enabled at the organization level. Additionally, CodeQL default analysis must be enabled on the repository. While CodeQL is not the tool performing the AI analysis, the AI detection engine relies on it to function.

Availability

This feature is now in public preview on github.com for customers with GitHub Code Security (GitHub Advanced Security). It can be enabled for repositories or organizations that use CodeQL default setup, after being allowed by an enterprise owner at the enterprise level.

Billing

During public preview, AI security detections require a GitHub Copilot license and draw down your organization’s AI credits. Usage consumes AI credits only when detections run. Learn more about AI credits billing.

To learn more, check out our GitHub Code Scanning documentation. Join the discussion and leave feedback on the Code scanning shows AI security detections on PRs announcement in the GitHub Community.

The post Code scanning shows AI security detections on pull requests appeared first on The GitHub Blog.

Dependabot now waits until a new release has been available on its registry for at least three days before opening a version update pull request. This cooldown is now the default and requires no configuration.

New releases are a common entry point for supply chain attacks where a compromised or broken version can reach your dependency updates before maintainers and the community have caught it. A short delay gives that signal time to surface, so you are less likely to merge a bad release the moment it ships.

A few things to know:

The default applies only to version updates. Security updates still open immediately, so critical fixes are never delayed.

You stay in control. Use the cooldown option in your .github/dependabot.yml to set a different window or opt out entirely.

This default applies to Dependabot version updates across all supported ecosystems on github.com and will take effect in GitHub Enterprise Server (GHES) 3.23.

Learn more in our docs about Dependabot cooldowns.

The post Dependabot version updates introduce default package cooldown appeared first on The GitHub Blog.

You can now run a security review on your in-flight code changes directly from the GitHub Copilot app. The /security-review slash command is shipping in public preview, bringing the same AI-driven vulnerability scanning already available in Copilot CLI into your everyday coding workflow.

What it does

/security-review analyses your current workstream changes and returns:

• High-confidence security findings, scored by severity and confidence.
• Actionable suggestions you can apply and reverify without leaving Copilot.
• A focused, prioritised view so you can fix the issues that matter before code lands.

The scan is tuned to catch common, high-impact vulnerability classes such as injection flaws, cross-site scripting, insecure data handling, path traversal and weak cryptography.

Why it matters

The /security-review command gives you a way to catch issues while you’re still working without leaving your coding environment. It complements GitHub code scanning, Dependabot, and secret scanning by giving you a lightweight, on-demand check on your local changes.

How to try it

Open a project in the Copilot app, make your code changes, and run /security-review to scan those changes. The command is available to Copilot Free, Pro, Business, and Enterprise users during public preview.

Join the discussion and share your feedback in the GitHub Community.

The post Security reviews now available in the GitHub Copilot app appeared first on The GitHub Blog.

Starting today, security teams can create, edit, and manage secret scanning custom patterns with the REST API.

What’s new

The following endpoints are generally available:

• GET .../secret-scanning/custom-patterns list patterns
• POST .../secret-scanning/custom-patterns create patterns
• PATCH .../secret-scanning/custom-patterns/{id} update patterns
• DELETE .../secret-scanning/custom-patterns delete patterns

These endpoints are available at repository, organization, and enterprise levels for secret scanning customers. They cover basic CRUD operations, including creation, deletion, and modification of custom patterns. Dry runs and the final publishing step are still currently completed in the UI. You can follow the GitHub changelog for future updates.

Learn more

Learn more in the REST API documentation for secret scanning and about custom patterns.

The post Manage secret scanning custom patterns via REST API appeared first on The GitHub Blog.