From e7756d2261b564fc1dee6848741a819a2a7f51d7 Mon Sep 17 00:00:00 2001 From: Daniel Johnson Date: Tue, 1 Sep 2026 23:18:08 +0000 Subject: [PATCH 1/4] Fixes release date on GHES patch 113 (#63029) --- data/release-notes/enterprise-server/3-17/20.yml | 2 +- data/release-notes/enterprise-server/3-18/14.yml | 2 +- data/release-notes/enterprise-server/3-19/11.yml | 2 +- data/release-notes/enterprise-server/3-20/7.yml | 2 +- data/release-notes/enterprise-server/3-21/5.yml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/data/release-notes/enterprise-server/3-17/20.yml b/data/release-notes/enterprise-server/3-17/20.yml index 286b097b3436..86c3bfc85b4a 100644 --- a/data/release-notes/enterprise-server/3-17/20.yml +++ b/data/release-notes/enterprise-server/3-17/20.yml @@ -1,4 +1,4 @@ -date: '2026-08-25' +date: '2026-09-01' sections: security_fixes: - | diff --git a/data/release-notes/enterprise-server/3-18/14.yml b/data/release-notes/enterprise-server/3-18/14.yml index a69a6e4dc03c..6aad5c1b314e 100644 --- a/data/release-notes/enterprise-server/3-18/14.yml +++ b/data/release-notes/enterprise-server/3-18/14.yml @@ -1,4 +1,4 @@ -date: '2026-08-25' +date: '2026-09-01' sections: security_fixes: - | diff --git a/data/release-notes/enterprise-server/3-19/11.yml b/data/release-notes/enterprise-server/3-19/11.yml index 87f53e0cadde..00301c41bef2 100644 --- a/data/release-notes/enterprise-server/3-19/11.yml +++ b/data/release-notes/enterprise-server/3-19/11.yml @@ -1,4 +1,4 @@ -date: '2026-08-25' +date: '2026-09-01' sections: security_fixes: - | diff --git a/data/release-notes/enterprise-server/3-20/7.yml b/data/release-notes/enterprise-server/3-20/7.yml index 83ab8f5d337c..8ff1b269d03c 100644 --- a/data/release-notes/enterprise-server/3-20/7.yml +++ b/data/release-notes/enterprise-server/3-20/7.yml @@ -1,4 +1,4 @@ -date: '2026-08-25' +date: '2026-09-01' sections: security_fixes: - | diff --git a/data/release-notes/enterprise-server/3-21/5.yml b/data/release-notes/enterprise-server/3-21/5.yml index d3acec140ae6..b7b1dc7745df 100644 --- a/data/release-notes/enterprise-server/3-21/5.yml +++ b/data/release-notes/enterprise-server/3-21/5.yml @@ -1,4 +1,4 @@ -date: '2026-08-25' +date: '2026-09-01' sections: security_fixes: - | From 3765e327bf9dbfa095b607df636832491dda22c5 Mon Sep 17 00:00:00 2001 From: Ria Gopu Date: Wed, 2 Sep 2026 11:22:17 +0000 Subject: [PATCH 2/4] Update Copilot code review docs: steps, severity, custom instructions, effort levels (#62982) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: hubwriter <54933897+hubwriter@users.noreply.github.com> Copilot-Session: bfbc7307-0001-4321-bfe0-cf122b41ba76 --- .../request-a-code-review/use-code-review.md | 44 +++++++++---------- .../custom-instructions-information.md | 2 + 2 files changed, 24 insertions(+), 22 deletions(-) diff --git a/content/copilot/how-tos/use-copilot-agents/request-a-code-review/use-code-review.md b/content/copilot/how-tos/use-copilot-agents/request-a-code-review/use-code-review.md index b7a48aca3e1a..25546e4d8a1f 100644 --- a/content/copilot/how-tos/use-copilot-agents/request-a-code-review/use-code-review.md +++ b/content/copilot/how-tos/use-copilot-agents/request-a-code-review/use-code-review.md @@ -45,8 +45,19 @@ These instructions explain how to use {% data variables.copilot.copilot_code-rev ![Screenshot of a code review left by {% data variables.product.prodname_copilot_short %}.](/assets/images/help/copilot/code-review/review-comment@2x.png) + {% data variables.product.prodname_copilot_short %} labels each comment with a severity level of "High," "Medium," or "Low" to help you prioritize the issues it finds based on their importance. + By default, {% data variables.product.prodname_copilot_short %} leaves a "Comment" review, not an "Approve" review or a "Request changes" review. This means that, by default, {% data variables.product.prodname_copilot_short %}'s reviews do not count toward required approvals for the pull request. However, if configured to do so, {% data variables.product.prodname_copilot_short %} can leave "Approve" reviews. For more information, see [Pull request approvals from {% data variables.product.prodname_copilot_short %}](#pull-request-approvals-from-copilot). +1. Where possible, {% data variables.product.prodname_copilot_short %}'s feedback includes suggested changes which you can apply with a couple of clicks. + + If you're happy with the changes, you can accept a single suggestion from {% data variables.product.prodname_copilot_short %} and commit it, or accept a group of suggestions together in a single commit. For more information, see [AUTOTITLE](/pull-requests/how-tos/review-pull-requests/incorporating-feedback-in-your-pull-request). + + You can also invoke {% data variables.copilot.copilot_cloud_agent %} to implement suggested changes. To do this, you must: + + * Enable {% data variables.copilot.copilot_code-review %} and {% data variables.copilot.copilot_cloud_agent %}. + * On review comments from {% data variables.copilot.copilot_code-review %}, click **Fix with {% data variables.product.prodname_copilot_short %}**. This creates a draft comment on the pull request, where you can instruct {% data variables.product.prodname_copilot_short %} to address specific feedback. You can then select whether {% data variables.product.prodname_copilot_short %} will create a new pull request against your branch or a commit to the same pull request with the suggestions applied. + 1. {% data variables.product.prodname_copilot_short %}'s review comments behave like review comments from humans. You can add reactions to them, comment on them, resolve them and hide them. Any comments you add to {% data variables.product.prodname_copilot_short %}'s review comments will be visible to humans, but they won't be visible to {% data variables.product.prodname_copilot_short %}, and {% data variables.product.prodname_copilot_short %} won't reply. @@ -57,28 +68,6 @@ You can also request a review from {% data variables.product.prodname_copilot_sh By default, you manually request a review from {% data variables.product.prodname_copilot_short %} on each pull request, in the same way you would request a review from a human. However, you can set up {% data variables.product.prodname_copilot_short %} to automatically review all pull requests. See [AUTOTITLE](/copilot/how-tos/copilot-on-github/set-up-copilot/configure-automatic-review). -## Choosing a review effort level - -{% data variables.copilot.copilot_code-review_short %} supports multiple review effort levels, so you can choose the level of thoroughness that matches the criticality of your code. - -* **Lite**: Standard review that provides fast, targeted feedback on common issues such as bugs, security vulnerabilities, and style inconsistencies (default). -* **Balanced**: Deeper analysis of complex logic, security-sensitive code, and cross-service changes, using a higher-reasoning model. - -You can select the review effort level in the pull request, under the **Reviewers** section where {% data variables.product.prodname_copilot_short %} appears as a reviewer. Organization owners and repository administrators can also set a default effort level for automatic reviews. - -For more information, see [AUTOTITLE](/copilot/concepts/agents/code-review#review-effort-level). - -## Working with suggested changes provided by {% data variables.product.prodname_copilot_short %} - -Where possible, {% data variables.product.prodname_copilot_short %}'s feedback includes suggested changes which you can apply with a couple of clicks. - -If you're happy with the changes, you can accept a single suggestion from {% data variables.product.prodname_copilot_short %} and commit it, or accept a group of suggestions together in a single commit. For more information, see [AUTOTITLE](/pull-requests/how-tos/review-pull-requests/incorporating-feedback-in-your-pull-request). - -You can also invoke {% data variables.copilot.copilot_cloud_agent %} to implement suggested changes. To do this, you must: - -* Enable {% data variables.copilot.copilot_code-review %} and {% data variables.copilot.copilot_cloud_agent %}. -* On review comments from {% data variables.copilot.copilot_code-review %}, click **Fix with {% data variables.product.prodname_copilot_short %}**. This creates a draft comment on the pull request, where you can instruct {% data variables.product.prodname_copilot_short %} to address specific feedback. You can then select whether {% data variables.product.prodname_copilot_short %} will create a new pull request against your branch or a commit to the same pull request with the suggestions applied. - ## Requesting a re-review from {% data variables.product.prodname_copilot_short %} When you push changes to a pull request that {% data variables.product.prodname_copilot_short %} has reviewed, it won't automatically re-review your changes unless you've configured it to review new pushes after enabling automatic reviews. @@ -89,6 +78,17 @@ To automatically request re-reviews from {% data variables.product.prodname_copi > [!NOTE] When re-reviewing a pull request, {% data variables.product.prodname_copilot_short %} may repeat the same comments again, even if they have been dismissed with the "Resolve conversation" button or downvoted with the thumbs down (:-1:) button. +## Choosing a review effort level + +With review effort levels, you can choose the level of thoroughness of {% data variables.product.prodname_copilot_short %}'s review that matches the criticality of your code. + +* **Lite**: Cost-efficient review that provides targeted feedback on glaring issues such as bugs, security vulnerabilities, and style inconsistencies. +* **Balanced**: Deeper analysis of complex logic, security-sensitive code, and cross-service changes, using a higher-reasoning model. + +You can select the review effort level in the pull request before you request a review from {% data variables.product.prodname_copilot_short %}, under the **Reviewers** section where {% data variables.product.prodname_copilot_short %} appears as a reviewer. Organization owners and repository administrators can also set a default effort level for automatic reviews. + +For more information, see [AUTOTITLE](/copilot/concepts/agents/code-review#review-effort-level). + ## Pull request approvals from {% data variables.product.prodname_copilot_short %} > [!NOTE] diff --git a/data/reusables/copilot/code-review/custom-instructions-information.md b/data/reusables/copilot/code-review/custom-instructions-information.md index 8bc5a541e511..99761b405e4c 100644 --- a/data/reusables/copilot/code-review/custom-instructions-information.md +++ b/data/reusables/copilot/code-review/custom-instructions-information.md @@ -6,6 +6,8 @@ Use an `AGENTS.md` file in the root of your repository to provide additional rep Use `.github/instructions/**/*.instructions.md` files for path-specific instructions that only apply when reviewing matching files. This is useful when different parts of the repository follow different conventions, require specialized checks, or need review guidance tailored to a particular language, framework, or subsystem. +{% data variables.copilot.copilot_code-review_short %} also reads custom instructions from `CLAUDE.md`, `GEMINI.md`, and `REVIEW.md` files in your repository, if they exist. + For more information, see [AUTOTITLE](/copilot/how-tos/copilot-on-github/customize-copilot/add-custom-instructions/add-repository-instructions). {% data reusables.copilot.code-review.custom-instructions-limit %} From bacc017819ea1c6e6793723441adea40eafeeaab Mon Sep 17 00:00:00 2001 From: hubwriter Date: Wed, 2 Sep 2026 13:30:05 +0000 Subject: [PATCH 3/4] Copilot CLI: Update sandboxing articles (#63042) --- .../agents/copilot-cli/understanding-local-sandboxing.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/copilot/concepts/agents/copilot-cli/understanding-local-sandboxing.md b/content/copilot/concepts/agents/copilot-cli/understanding-local-sandboxing.md index 12f5b36d2a49..b88dc94887af 100644 --- a/content/copilot/concepts/agents/copilot-cli/understanding-local-sandboxing.md +++ b/content/copilot/concepts/agents/copilot-cli/understanding-local-sandboxing.md @@ -63,15 +63,15 @@ When **Include working directory** is enabled in the filesystem settings for loc ### Tools on your PATH -To run a program such as `python` or `git`, the sandbox has to let the command see the directory the program lives in. Your `PATH` environment variable lists these directories, and {% data variables.product.prodname_copilot_short %} grants them **read-only** access, along with directories named by related tool variables such as `GOPATH`, `CARGO_HOME`, and `PYTHONPATH`. Read-only is the right level for external tools: a command needs to run `git`, not modify it. For the complete list of the `PATH` and toolchain environment variables the sandbox inspects, and how each one is interpreted, see [AUTOTITLE](/copilot/reference/copilot-cli-reference/cli-command-reference#sandbox-tool-directory-grants). +To run a program such as `python` or `git`, the sandbox has to let the command see the directory the program lives in. When **Allow dev tool access** is enabled—as it is by default—{% data variables.product.prodname_copilot_short %} grants **read-only** access to the directories listed in your `PATH` environment variable, along with directories named by related tool variables such as `GOPATH`, `JAVA_HOME`, and `PYTHONPATH`. Read-only is the right level for external tools: a command needs to run `git`, not modify it. If you turn **Allow dev tool access** off, these directories are no longer granted automatically and must come from your own allow rules. For the complete list of the `PATH` and toolchain environment variables the sandbox inspects, and how each one is interpreted, see [AUTOTITLE](/copilot/reference/copilot-cli-reference/cli-command-reference#sandbox-tool-directory-grants). ### System and profile locations -Standard system locations and your user profile (home) directory are granted read-only, so that commands can read configuration files and shared libraries without being able to change them. +On macOS, standard system locations are granted read-only so that commands can load shared libraries and read system configuration without being able to change them. The application directories in your user profile are also granted read-only when **Allow dev tool access** is enabled, so that commands can read the tools you have installed there without being able to modify them. ### Package-manager caches -To let installs and builds work inside the sandbox, {% data variables.product.prodname_copilot_short %} also grants access to the caches and registries used by common package managers and toolchains—read-only for registries and toolchains, and read/write for build caches. In the `/sandbox policy` report, this appears as **dev-tool access**. +To let installs and builds work inside the sandbox, {% data variables.product.prodname_copilot_short %} also grants access to the caches and registries used by common package managers and toolchains—read-only for most locations, and read/write for selected writable locations, such as build caches and package-manager dependency stores. In the `/sandbox policy` report, this appears as **dev-tool access**. ### Git repositories From a2272879cca7a4da65370ea71b959bddb05f42a4 Mon Sep 17 00:00:00 2001 From: Isaac Brown <101839405+isaacmbrown@users.noreply.github.com> Date: Wed, 2 Sep 2026 13:46:06 +0000 Subject: [PATCH 4/4] Document model access for agent apps (#63011) Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- content/copilot/concepts/agents/agent-apps.md | 4 ++++ .../manage-availability-of-default-models.md | 17 +++++++++++++++-- .../cloud-agent/use-agent-apps.md | 5 +++++ .../copilot/model-access-agent-apps.md | 1 + 4 files changed, 25 insertions(+), 2 deletions(-) create mode 100644 data/reusables/copilot/model-access-agent-apps.md diff --git a/content/copilot/concepts/agents/agent-apps.md b/content/copilot/concepts/agents/agent-apps.md index d323807acbaf..28032916b5c6 100644 --- a/content/copilot/concepts/agents/agent-apps.md +++ b/content/copilot/concepts/agents/agent-apps.md @@ -17,6 +17,8 @@ contentType: concepts For example, an {% data variables.copilot.agent_app %} could analyze your product analytics, scan your application for security vulnerabilities, or add feature flags to a pull request, then connect back to the partner's systems to complete the task. +You can view available apps on [{% data variables.product.prodname_marketplace %}](https://github.com/marketplace?type=apps&category=agent-apps). + ## Where you can use {% data variables.copilot.agent_apps %} {% data reusables.copilot.agent-apps-entrypoints %} @@ -38,6 +40,8 @@ To use an {% data variables.copilot.agent_app %}, the {% data variables.product. * When you install an {% data variables.copilot.agent_app %}, {% data variables.product.github %} highlights that the app includes agent features and asks you if you want to enable them. For more information, see [AUTOTITLE](/apps/using-github-apps/about-using-github-apps). * If the app is installed in an organization owned by an enterprise, an administrator must also enable the "{% data variables.copilot.agent_apps %}" {% data variables.product.prodname_copilot_short %} policy before the agent features become available. For more information, see the "Next steps" section. +{% data reusables.copilot.model-access-agent-apps %} See [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-availability-of-default-models). + ## Billing {% data reusables.copilot.agent-apps-billing %} diff --git a/content/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-availability-of-default-models.md b/content/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-availability-of-default-models.md index a38911d23835..12b35c4754cf 100644 --- a/content/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-availability-of-default-models.md +++ b/content/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-availability-of-default-models.md @@ -29,10 +29,12 @@ This sets a baseline that you can add to with more granular controls. For models {% data reusables.enterprise-accounts.configure-allowed-models %} 1. Select a status for each model in the list: - * **Enabled** for everyone. - * **Disabled** for everyone. + * **Enabled** for every user and {% data variables.copilot.agent_app %}. + * **Disabled** for every user and {% data variables.copilot.agent_app %}. * **Delegate** the decision to organizations or enterprise teams and apps. +{% data reusables.copilot.model-access-agent-apps %} + ### Checking for unconfigured models {% data reusables.copilot.model-autoenablement %} @@ -96,6 +98,17 @@ To grant access to an enterprise team: 1. Click the **Default models** tab. 1. For each model that the team should receive access to beyond the enterprise baseline, set the dropdown to **Enabled**. +### Granting access to {% data variables.copilot.agent_apps %} + +{% data reusables.copilot.agent-apps-intro %} See [AUTOTITLE](/copilot/concepts/agents/agent-apps). + +Ensure models you want to enable specifically for apps are set to **Delegate to Enterprise Teams/Apps** in your enterprise's model policies. + +{% data reusables.enterprise-accounts.ai-controls-tab %} +{% data reusables.enterprise-accounts.copilot-sidebar %} +1. Under **Models**, click **Configure app models**. +1. For each available model you want to enable, change the dropdown from **Optional** to **Enabled**. + ## Further reading * [AUTOTITLE](/copilot/reference/supported-surfaces-for-policies) diff --git a/content/copilot/how-tos/use-copilot-agents/cloud-agent/use-agent-apps.md b/content/copilot/how-tos/use-copilot-agents/cloud-agent/use-agent-apps.md index bb374844ab74..a069cb2cc4e7 100644 --- a/content/copilot/how-tos/use-copilot-agents/cloud-agent/use-agent-apps.md +++ b/content/copilot/how-tos/use-copilot-agents/cloud-agent/use-agent-apps.md @@ -18,6 +18,11 @@ category: Before you can use an {% data variables.copilot.agent_app %}, the {% data variables.product.prodname_github_app %} must be installed on the account or organization that owns the repository, and agent features must be enabled for the app. If the repository is owned by an organization that belongs to an enterprise, the "{% data variables.copilot.agent_apps_caps %}" {% data variables.product.prodname_copilot_short %} policy must also be enabled in your enterprise settings. +## Installing an agent app + +1. View available apps on [{% data variables.product.prodname_marketplace %}](https://github.com/marketplace?type=apps&category=agent-apps). +1. On the app page, click **Add**, then install the app on your personal account or organization. + ## Authorizing an agent app The first time you use an {% data variables.copilot.agent_app %}, {% data variables.product.github %} prompts you to authorize the app through an OAuth flow. Follow the prompts to authorize the app before the agent runs. For more information, see [AUTOTITLE](/apps/using-github-apps/authorizing-github-apps). diff --git a/data/reusables/copilot/model-access-agent-apps.md b/data/reusables/copilot/model-access-agent-apps.md new file mode 100644 index 000000000000..35558dd5772a --- /dev/null +++ b/data/reusables/copilot/model-access-agent-apps.md @@ -0,0 +1 @@ +By default, {% data variables.copilot.agent_apps %} have access to the models that are enabled in the organization or personal account where the app is installed. However, in the enterprise teams mode for model access, available models for {% data variables.copilot.agent_apps_short %} are controlled at the enterprise level.