GitHub Copilot Code Review for Bots and Large Pull Requests
On this page
Quick answer
GitHub announced on August 27, 2026 that Copilot code review can automatically review bot-authored pull requests, give Copilot cloud-agent pull requests a full agentic review, and review very large pull requests beyond its former 300-file or 20,000-line limit.
Those changes expand eligibility, not assurance. Automatic review still depends on organization policy, AI-credit budget, repository configuration, runner availability, supported files, usable context, and human validation.
What changed
| Pull-request case | New behavior | Boundary to preserve |
|---|---|---|
| Bot-authored PR | Automatic review can run when the unlicensed-user policy path is enabled | Organization-paid usage and billing owner must be clear |
| Copilot cloud-agent PR | Automatically requested review can use the full agentic experience | Runner or workflow failure can still cause a limited review |
| Very large PR | Former 300-file or 20,000-line limit no longer applies | Larger scope can increase cost and still contain excluded or missed files |
| Copilot review comment | Resolver can choose Addressed, Won’t fix, or Incorrect | A resolution label records disposition; it does not prove the code is safe |
Configure automatic review deliberately
Choose the repositories, target branches, authors, and review effort that should trigger automatic review. Keep a small pilot before enabling every pull request: a busy bot or automation can create organization-paid reviews at a rate that manual requests never reached.
For bot authors without a Copilot license, GitHub documents two required policies: AI credits paid usage and Allow members without a Copilot license to use Copilot code review in GitHub.com. The second policy is restrictive and repository access remains scoped to organizations where it is explicitly enabled.
Use the AI-credit and billing guide before widening automatic review.
Large does not mean complete
Removal of the old size limit does not mean every file or issue is examined. GitHub excludes dependency-management files, logs, SVG files, and many vendor or generated locations. Copilot can also miss issues in files it does review.
For a large pull request, record:
- total changed files and lines;
- files excluded by GitHub or repository policy;
- generated, vendored, binary, lock, log, and SVG changes needing another control;
- effort level, AI-credit use, Actions minutes, elapsed time, and failures;
- test, static-analysis, security, owner, and human-review coverage.
Prefer smaller independently reviewable pull requests when the change can be split safely. Expanded capacity is not a reason to remove normal review discipline.
Agentic context and runner fallback
Copilot code review can gather full-project context and use repository instructions, agent skills, and configured MCP servers. GitHub says these agentic capabilities run on GitHub Actions runners. Larger hosted runners cost more per minute; self-hosted runners do not consume Actions minutes.
If hosted runners are disabled, unavailable, or the supporting workflow fails, GitHub can still generate a review, but without the added agentic capabilities. Treat that as a different evidence class and surface the fallback in the pull-request check.
Review the permissions and data scope of instructions, skills, and MCP servers separately. More context can improve relevance, but it also expands what the review process may read or invoke.
Use resolution reasons as feedback, not proof
Addressed, Won’t fix, and Incorrect can make review outcomes easier to audit. Require a short rationale or linked evidence for consequential findings. A closed conversation does not establish that a suggested fix was applied correctly, that tests passed, or that a risk was accepted by the right owner.
Validation gate
Run the Copilot code review readiness tool before enabling the workflow broadly. Keep branch protection, required reviewers, test suites, security checks, ownership rules, and deployment approvals independent from Copilot’s result.
Frequently asked questions
Can Copilot automatically review pull requests authored by bots?
Yes, when automatic review and the required organization-paid policy path are enabled. Bot-authored reviews have no Copilot-licensed author by default, so billing attribution must be resolved separately.
Can Copilot fully review a pull request opened by Copilot cloud agent?
GitHub announced that automatically requested reviews of Copilot cloud-agent pull requests can now use full agentic review instead of the former limited fallback. Runner and context failures can still produce a limited review.
Does Copilot code review still have a 300-file or 20,000-line limit?
GitHub says the former 300-file or 20,000-line pull-request limit no longer applies. This expands eligibility; it does not prove complete coverage, predictable cost, or correct findings.
Can Copilot code review replace a human reviewer?
No. GitHub says Copilot can miss problems and make mistakes. Validate its feedback, run required tests and security checks, and retain accountable human review.
Official sources
- GitHub changelog: resolution reasons and expanded capabilities
- GitHub Docs: About Copilot code review
- GitHub Docs: Configuring automatic code review
- GitHub Docs: Files excluded from code review
Source check: August 28, 2026. Recheck policies, effort levels, runners, exclusions, billing, and current product behavior before rollout.