Weekly GitHub Copilot Roundup: Metrics, AppSec, and Governance

by TechHub

This week, GitHub Copilot got easier to measure and easier to govern, with expanded usage metrics (including Copilot app activity) and new repository-level reporting that links adoption to where work ships. Security workflows tightened as AI detections land directly in pull requests, agentic autofix can open draft remediation PRs with validation reruns, and the Copilot app adds an on-demand /security-review check. On the tooling side, Visual Studio and JetBrains pushed multi-model choice, endpoint control, and safer integrations (including MCP trust and BYOK endpoints), while Copilot code review became more configurable and even usable from GitHub Mobile for quick fixes.

This Week's Overview

Copilot becomes measurable: new enterprise, org, and repo reporting

Building on last week's improvements to usage metrics coverage and attribution (including better IDE/plugin details and more accurate credit attribution), GitHub expanded the Copilot usage metrics API to include activity from the GitHub Copilot app in both enterprise and organization reports (1-day and 28-day). The update adds daily active users plus deeper breakdowns of sessions, requests, prompts, and token totals, which makes it easier to tie adoption to cost and to spot unusual usage spikes.

Repository-level Copilot usage metrics are now generally available, adding REST API endpoints that report daily per-repository pull request activity for both the Copilot coding agent and Copilot code review across enterprises and organizations. This shifts reporting from “who used Copilot” to “where Copilot is influencing delivery”, which is useful for team-level enablement, license true-ups, and deciding which repos should get stricter guardrails.

Security workflows tighten: AI findings on PRs and agent-driven fixes

This week GitHub pushed Copilot deeper into AppSec workflows, with new ways to surface findings directly in pull requests and to let agents propose and validate fixes, extending last week's theme that Copilot is becoming part of the “issue to merge” loop with more controllable, auditable steps. The theme is shifting left without losing auditability: findings show up where code changes happen, and fixes arrive as draft PRs with reruns and traces rather than silent edits.

AI security detections appear directly on pull requests

GitHub code scanning now shows AI-powered security detections on pull requests, expanding coverage beyond CodeQL-supported languages and frameworks. The capability is in public preview for GitHub Advanced Security customers, and it uses AI credits tied to a GitHub Copilot license, so teams should budget for both detection volume and the review overhead.

Because the results land in the PR experience, this also changes how you triage: reviewers can address issues during code review instead of after merge when default setup scans finish. If you are standardizing on CodeQL default setup, this preview effectively adds a second “lens” for languages and frameworks where CodeQL rules are thinner.

Agentic autofix for code scanning alerts (public preview)

Agentic autofix for GitHub code scanning alerts is now in public preview, letting Copilot explore the repo, generate a fix, validate it by rerunning CodeQL, and open a draft pull request, which builds on last week's agent governance additions (session streaming, budgets, and credit limits) by turning remediation into a traceable workflow with explicit reruns and costs. GitHub also documents how to trigger it (including via the REST API) and calls out the cost model: AI Credits plus GitHub Actions minutes for the validation runs.

The practical implication is that “autofix” now looks more like a controlled remediation workflow than a one-click patch. Teams that already gate merges on code scanning can treat the draft PR as an assistive starting point, while still requiring code owner review and standard CI before merge.

On-demand security review inside the Copilot app

The GitHub Copilot app added a /security-review slash command (public preview) to run an on-demand security review of in-flight code changes, returning prioritized findings and suggested fixes, continuing last week's Copilot app focus (canvases and app-first skills) by adding a concrete pre-PR security check developers can run without leaving the app. It is positioned as a lightweight check during development that complements code scanning, Dependabot, and secret scanning, which may help developers catch issues before they open a PR.

For teams, this creates a new “pre-PR” habit worth documenting: when to run /security-review, how to interpret findings, and when to escalate to full code scanning or a security engineer. It is also another place where AI credits and policy may need attention if usage grows quickly.

Copilot code review and PR fixing get more configurable (and more mobile)

GitHub continued rounding out the “Copilot participates in your PR workflow” story, picking up from last week's preview of deeper reasoning controls in code review by adding more predictable configuration, repo-specific setup, and new places to apply fixes. Two changes stand out: code review customization becomes more repo-aware, and GitHub Mobile gets a tighter loop for applying fixes from review comments.

Copilot code review customization, setup steps, and firewall controls

Copilot code review added several knobs aimed at making reviews more consistent across branches and environments. Custom instructions are now read from the PR head branch (so the instructions match the actual change), more instruction file names are supported, and repositories can define setup steps via a copilot-code-review.yml file.

Reviews also now run behind a configurable default-on firewall, which is likely to matter for regulated environments that need tighter egress control and predictable network boundaries. GitHub also split organization runner settings from the Copilot cloud agent, letting admins choose runner types independently rather than treating them as a single coupled configuration.

GitHub Mobile can “Fix with Copilot” straight from review comments

GitHub Mobile (iOS and Android) now includes a “Fix with Copilot” entry point directly from Copilot code review pull request comments, accessible from the PR main view and from individual review comments, which follows last week's emphasis on making agent sessions first-class and reviewable by bringing the “apply the fix” loop into another client surface. This turns review feedback into an actionable workflow even when you are away from a laptop, which can be useful for maintaining momentum on small fixes and follow-ups.

If your team uses Copilot code review heavily, this is worth calling out in your process docs: who is allowed to apply Copilot-proposed changes from mobile, and how to ensure those changes still go through normal CI and review expectations.

Copilot in IDEs goes multi-model and more governable

Model choice and governance showed up repeatedly across tools this week, extending last week's model churn and policy-audit theme (new model options, planned deprecations, and Auto defaults) into more explicit selection UI, safer tool connections, and endpoint control. The practical outcome is that teams can start treating Copilot like a configurable platform component instead of a single opaque assistant.

Visual Studio: model management, usage tracking, MCP trust, and agent capabilities

Visual Studio updates made model selection and long chats easier to manage, including UI for comparing model capabilities (like context window size and vision support) and monitoring context window and Copilot plan usage during longer conversations. That kind of visibility matters when teams are troubleshooting why a chat “forgot” earlier context or when a plan limit starts constraining workflows.

The June update for GitHub Copilot in Visual Studio 2026 adds usage tracking and alerts for usage-based billing, plus trust validation for MCP servers (Model Context Protocol) to help reduce the risk of connecting Copilot to untrusted tooling, continuing last week's push for governed MCP usage and better spend visibility inside IDEs. It also calls out GA for C++ modernization agent scenarios and tighter pull request workflows via Copilot Chat, reflecting how Copilot is increasingly embedded into end-to-end delivery rather than isolated code completion.

Visual Studio 18.8 also introduced built-in Agent Skills: reusable Copilot capabilities for common .NET and Azure tasks like API endpoint work, performance review, Azure deployment chains (including azd, Bicep, and Terraform), Kusto (KQL) querying, and Microsoft Foundry tasks. These skills effectively encode “how we do this here” into repeatable building blocks, which can reduce prompt sprawl and make Copilot results more consistent across a team.

JetBrains: broader BYOK endpoints and new customization hooks

GitHub Copilot for JetBrains expanded Bring Your Own Key (BYOK) options by supporting OpenAI-compatible custom endpoints, which should help teams route traffic through internal gateways or approved providers, building on last week's JetBrains momentum as Copilot Agent reached JetBrains via ACP and made multi-step agent work more native in that IDE. The update also adds richer plugin-based customizations and introduces Claude provider support for custom agents (preview), widening the set of models and agent behaviors teams can standardize on inside JetBrains IDEs.

The same update mentions local sandboxing and Copilot CLI debugger skill improvements (both in preview), which points toward safer, more controlled agent execution patterns. If you are rolling Copilot out in a mixed-IDE org, this brings JetBrains closer to the level of governance and extensibility many teams already expect elsewhere.

Copilot app: GPT-5.6 model variants and how choice affects usage

GitHub's Rubber Duck Thursday stream explored GPT-5.6 models (Luna, Terra, Sol) inside the GitHub Copilot app and discussed how model choice changes Copilot behavior and usage, echoing last week's point that Copilot is training users to choose models intentionally as catalogs expand and defaults shift. Even if you do not treat a livestream as documentation, it reinforces a pattern: users are expected to choose models intentionally rather than relying on a single default.

If your organization is tracking usage and cost, model choice becomes a training topic, not just a personal preference. Model selection can affect token consumption, response quality for certain tasks, and the kind of context you can practically include without hitting limits.

Enterprise patterns for governed Copilot and AI platforms on Azure

Several pieces this week focused on building the platform around Copilot: network boundaries, policy enforcement, cost controls, and operational loops, reinforcing last week's governance thread (managed-settings.json, budgets, and session streaming) with a more infrastructure-centric view of how enterprises enforce those guardrails. The consistent message is that once Copilot usage scales, you need architecture that treats models and agents like shared services with measurable cost and enforceable policy.

A governed AI gateway that can front Copilot Chat and Copilot CLI

A detailed Azure pattern shows how to build a governed AI gateway using Azure API Management (APIM) to centralize access to Azure OpenAI and Azure AI Foundry models. The gateway enforces per-consumer entitlements, token limits, and budget-based model downgrades, then streams token metrics into Application Insights, giving teams a single place to manage both policy and telemetry.

The walkthrough includes Terraform deployment and demonstrates routing GitHub Copilot Chat and Copilot CLI through the gateway. For enterprises, this is a concrete option when “BYOK” is not enough and you need private endpoints, managed identity, and consistent controls across many consumers.

Hypervelocity Engineering mapped to Azure AI Landing Zones

Another Azure Architecture post frames Hypervelocity Engineering (HVE) as an operating model for continuously evolving enterprise AI platforms, organized around an RPIR loop (Research, Plan, Implement, Review). It maps those ideas to an Azure AI Landing Zone reference architecture emphasizing Infrastructure as Code (IaC), Policy as Code, DevSecOps, Zero Trust, and continuous observability.

For teams trying to standardize how they ship AI-enabled developer experiences (including Copilot integrations), this gives a vocabulary for balancing iteration speed with guardrails. It also provides a practical architecture anchor: landing zones that can be evolved continuously rather than rebuilt per project.

MCP and skills workflows: richer outputs, safer connections, and less prompt sprawl

This week's Copilot ecosystem content included two complementary threads: MCP servers are becoming more capable (returning more than text), and skills/prompt libraries need maintenance to stay usable, continuing last week's focus on MCP spreading into CI and tool-driven workflows with more emphasis on output types and operational hygiene. Together they point toward a future where teams curate reusable “capabilities” instead of relying on ad-hoc prompting.

MCP servers can return images and interactive apps

A tutorial shows MCP servers returning binary image results and interactive MCP apps, not just text. The example uses a FastMCP-based Python server that integrates Azure AI Search and Azure Blob Storage, then is consumed from GitHub Copilot in VS Code, which makes it easier to build assistants that can surface diagrams, screenshots, or UI-driven mini-tools as part of a workflow.

For developers building internal Copilot extensions, this expands what “context” and “results” can look like. It also increases the importance of trust validation and governance around MCP servers, since richer outputs create more surface area for data leakage and policy violations if not controlled.

Auditing SKILL.md libraries as skills replace prompt files

As Copilot and IDE tooling shift from ad-hoc prompt files to “skills”, one guide highlights a real maintenance problem: skills folders tend to accumulate duplicates, missing SKILL.md files, and broken entries across multiple tool-specific setups, which lines up with last week's expansion of skills and MCP plugins by showing the less glamorous work of keeping shared capability libraries usable. It provides a stocktake checklist and shell one-liners to find missing SKILL.md files and detect duplicates, which is useful if your team maintains shared agent instructions or slash-command catalogs.

A separate Visual Studio Code-focused update video for VS Code 1.129 calls out the same migration trend, including changes to the Agents window and Agent Host Protocol (AHP), plus moving prompt files to skills. If you want predictable agent behavior across environments, this is a hint that skills management is becoming a first-class dev workflow rather than a personal hack.

Copilot-assisted modernization and workflow integrations

The week also brought practical “how teams use Copilot” content, continuing last week's theme of agents moving from novelty to repeatable workflows (modernization agents, CI diagnostics, and environment setup skills) by showing training material and integrations that make those workflows easier to adopt. These are less about new product switches and more about turning Copilot into repeatable team workflows.

A beginner-friendly path to modernizing ASP.NET to .NET 10 with a Copilot agent

Microsoft published a free, open-source course, “.NET Modernization for Beginners”, that walks through upgrading a legacy ASP.NET app to .NET 10 using the GitHub Copilot modernization agent. The course includes assessment and planning artifacts and ends with deployment to Azure App Service, which makes it useful both as training material and as a template for real migration playbooks.

For teams with older .NET estates, the interesting angle is the workflow: using an agent to help with modernization tasks that are often repetitive and error-prone (project file changes, API replacements, incremental refactors). Treat it as a starting point for a governed modernization pipeline, not a substitute for architecture decisions and testing.

Jira integration: from work item to draft PR

A short setup guide shows how to install GitHub Copilot for Jira from the Atlassian Marketplace, authorize GitHub (including SSO considerations), enable organizations, and then use a Jira work item to create a draft pull request. This is a practical workflow improvement for teams that live in Jira: it reduces context switching and makes it easier to tie code changes back to planning artifacts.

If you are rolling this out broadly, the key operational detail is identity and access: ensure SSO behavior is understood, and decide which GitHub orgs are enabled so the integration does not accidentally expose repositories outside the intended scope.

Copilot in day-to-day engineering: accessibility fixes and community updates

A GitHub engineering video explains how a pull request accessibility issue was fixed by addressing a parsing problem and regrouping reviewers based on merge requirements, with Copilot helping the team investigate unfamiliar code. It is a useful reminder of where Copilot tends to help most in mature codebases: speeding up orientation and hypothesis testing when you are not the primary author.

A .NET AI Community Standup episode rounds up recent agent-related updates (Microsoft Agent Framework, Agent Skills for .NET), local AI approaches, and Copilot-assisted application modernization. If you are tracking the broader ecosystem rather than single-product changes, it provides a sense of how agents, skills, and local models are converging into practical developer workflows.

Other GitHub Copilot News

VS Code highlighted a small but practical technique: sharing a running website via the Integrated Browser to give Copilot more context while developing, which complements last week's push for richer context inputs like Copilot Vision and browser tools by offering another way to ground agent help in live UI state. It is low-impact, but it fits the broader pattern of feeding agents richer, situational context rather than pasting screenshots into chat.

One governance-focused post compiled a reference map of links for teams setting GitHub enterprise baselines, GitHub Actions supply-chain controls, GitHub Advanced Security rollout guidance, and Copilot governance topics like premium requests, extensions, and MCP security notes. If you are building internal guidance for Copilot adoption, it is a handy index even when you already have your own policies.