tftsr-devops_investigation/.github/COPILOT_SETUP.md

GitHub Copilot Code Review Setup

Overview

GitHub Copilot can automatically review pull requests when properly configured. This document explains how to enable Copilot code reviews for this repository.

Current Status

✅ Workflows Active: GitHub shows Copilot workflows are active:

• Copilot (pull-request-reviewer)
• Copilot cloud agent (copilot-swe-agent)
• CodeQL (code scanning)

⚠️ Configuration Needed: Copilot code reviews must be enabled through GitHub Advanced Security settings.

How GitHub Copilot Code Reviews Work

GitHub Copilot code reviews are not triggered via CODEOWNERS file (unlike human reviewers). Instead, they are configured through:

1. GitHub Advanced Security (requires GitHub Enterprise or GitHub Team plan)
2. Repository Settings → Security → Code security and analysis
3. Copilot Autofix (for security vulnerabilities)
4. Copilot Code Review (manual opt-in feature)

Setup Steps

Step 1: Enable GitHub Advanced Security

1. Navigate to: https://github.com/tftsr/apollo_nxt-trcaa/settings/security_analysis
2. Enable GitHub Advanced Security (if available with your plan)
3. Enable Dependabot alerts
4. Enable Code scanning (CodeQL)
5. Enable Secret scanning

Step 2: Enable Copilot Code Review

As of 2024-2026, GitHub Copilot code reviews can be enabled via:

Option A: Copilot Autofix (Security-focused)

1. Go to repository Settings → Code security and analysis
2. Enable Copilot Autofix under "Code scanning"
3. Copilot will suggest fixes for CodeQL alerts in pull requests

Option B: Copilot Workspace (Preview Feature)

1. Ensure your organization has Copilot Business or Enterprise
2. Navigate to: https://github.com/tftsr/apollo_nxt-trcaa/settings/copilot
3. Enable Copilot Code Review (if available)
4. Configure review triggers:
   • On all pull requests
   • On pull requests targeting protected branches
   • Manual trigger only

Step 3: Configure Review Rules

Add Copilot as a required check in branch protection:

# Via GitHub CLI
gh api repos/tftsr/apollo_nxt-trcaa/branches/main/protection/required_status_checks \
  --method PATCH \
  --field strict=true \
  --field contexts[]='rust-test' \
  --field contexts[]='frontend-test' \
  --field contexts[]='copilot-code-review'  # Add this line

Or via GitHub UI:

1. Go to Settings → Branches → Branch protection rules → main
2. Under "Require status checks to pass before merging"
3. Add copilot-code-review to required checks

Verification

To verify Copilot is reviewing PRs:

# Check if Copilot workflow ran on a PR
gh pr checks 27

# Check for Copilot comments on a PR
gh pr view 27 --comments | grep -i copilot

Triggering Manual Review

If Copilot code review is enabled but not automatic, you can trigger it manually:

1. Add a comment to the PR: @github-copilot review
2. Or use GitHub CLI: gh pr review 27 --request-changes --body "@github-copilot please review"

Current Configuration

Branch Protection (as of 2026-06-02):

• ✅ Required status checks: rust-test, frontend-test
• ✅ Require code owner reviews: Yes
• ✅ Required approving review count: 1
• ⚠️ Copilot code review: Not configured as required check

CODEOWNERS:

• Owner: @sarman
• Note: @github-copilot removed from CODEOWNERS (not a valid reviewer)

Limitations

• Plan Requirement: GitHub Advanced Security requires GitHub Enterprise or Team plan
• Private Repos: May have limited Copilot features depending on plan
• Availability: Copilot code review features are gradually rolling out
• Manual Trigger: Some orgs require manual trigger via comments

Alternative: CodeQL Analysis

If Copilot code review is not available, CodeQL provides automated code analysis:

1. CodeQL workflow is already active (.github/workflows/codeql-analysis.yml - dynamic)
2. Runs on every push to main and pull request
3. Scans for security vulnerabilities and code quality issues
4. Results appear in Security → Code scanning alerts

References

• GitHub Advanced Security Documentation
• GitHub Copilot for Business
• CodeQL Documentation

Action Items

To fully enable Copilot code reviews on this repo:

1. Verify GitHub plan includes Advanced Security features
2. Enable GitHub Advanced Security in repo settings
3. Enable Copilot Autofix (if available)
4. Configure Copilot code review triggers (if feature is available)
5. Add copilot-code-review to required status checks
6. Test on a sample PR to verify functionality

Contact

For questions about GitHub Advanced Security or Copilot features for the TFTSR organization, contact:

• GitHub Organization Admins
• DevOps Team

---

Last Updated: 2026-06-02 Status: Configuration pending - awaiting Advanced Security setup