Image: GitHub
Why it mattersA team enabling this saves some review time but accepts the risk that a model's approval allows a merge, so the decision belongs to the person who owns the branch protection rules.
GitHub announced today that Copilot's code review can now approve pull requests, in a changelog entry dated 1 September 2026. Every Copilot review already shows an approval assessment inside its overview comment; the new part is that an admin can let that approval count toward a repository's merge requirements, in the same way a human reviewer's does.
The feature is in public preview for the Copilot Pro, Pro+, Max, Business, and Enterprise plans.
The approval is off by default
By default, Copilot will not approve pull requests. Turning it on is a three-level decision, and higher levels control lower ones.
At the enterprise level, an admin can leave approvals off across the whole enterprise or pass the choice to organizations. At the organization level, an admin can turn approvals on org-wide, pass the choice to repository admins, enable it for named repositories, or turn it off org-wide. At the repository level, an admin can turn approvals on or off and pick which file paths Copilot is allowed to approve inside that repository.
What Copilot's approval does and does not do
The approval assessment appears on every review and signals whether Copilot thinks the pull request is ready to merge. That signal by itself does nothing to the merge requirement. The approval, once enabled, does.
If new commits are pushed after Copilot has approved, its approval is dismissed the same way a human reviewer's is, and the author can request a fresh review to get a new approval. That means an approval covers only the latest commit on the branch at the moment it was given.
The repository-level file path setting is the more detailed control worth reading carefully. An admin can allow Copilot to approve most of the repository while excluding paths where a model's approval carries too much risk, such as the CI configuration, the secrets loader, the deploy scripts, or the database migration folder.
Who approved what gets merged into main
For teams already using Copilot code review, the current behaviour has not changed. The assessment on every review is the same one that appeared yesterday. What has changed is a policy choice: whether a Copilot approval counts as one of the approvals branch protection requires before a merge.
Enabling it saves reviewer time on the pull requests where the code is straightforward and the diff is small. It also creates a class of merges where no human ever approved the change, only Copilot did. That is a real shift in who is accountable for what is merged into the default branch, and the honest approach is to decide it explicitly rather than by default. The three-level setting and the file-path filter are there so a team can enable the saving on the low-risk parts of a repository and keep human review where a wrong approval would be expensive.
The safest way to start for most teams is to leave it off enterprise-wide, allow specific repositories to opt in, and set path filters that exclude the parts of the repository that affect production behaviour, credentials, or CI. That keeps the option on where it helps and off where it does not.
Source
This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.
Get AI News in your inbox
New developer tools, model and agent releases, and how teams are actually using them to release software. Short, and only when there is something worth reading.
