Browse GitHub Copilot Blogs (12)

Jesse Houwing explains why GitHub Copilot cloud agent sessions can’t be spawned from GitHub Actions using GITHUB_TOKEN, and how GitHub’s accountability model (identity, billing, and auditability) shapes what “agentic workflows” can do today. He then lays out practical orchestration patterns that work, with concrete YAML examples.

Jesse Houwing explains how to stop GitHub Copilot agents from confidently inventing details about fast-moving tools by grounding them in a local clone of the real repository, then forcing answers to be backed by file-and-line citations from the source.

John Naguib explains a Copilot Studio billing change taking effect on September 1, 2026: existing agents and workflows built with the GitHub Copilot harness will start consuming Copilot Credits. The post breaks down what’s affected, how credit consumption works (authoring vs runtime), and what admins can review in PPAC to avoid cost surprises.

Hidde de Smet explains Agent Plugins 1.0, a small packaging standard that lets teams ship portable Agent Skills and MCP server definitions once, while keeping Copilot-specific extras in a namespaced folder. The post covers the required file layout, manifest and MCP schemas, and enterprise governance controls for plugin and MCP server policy.

DevClass reports on the Agent Plugins 1.0 specification, a cross-vendor effort to package agent skills and tool connectivity in a portable, file-system-based format. The goal is to make agent capabilities modular and reusable across compatible clients like VS Code and GitHub Copilot.

John Edward breaks down what GitHub Copilot does (and doesn’t) send to the service, how training and retention settings vary by subscription, and the practical security risks teams should plan for when using AI-assisted coding in real projects.

Hidde de Smet audits a local SKILL.md “skills” library spread across Claude Code, a shared .agents catalog, and GitHub Copilot’s VS Code setup, showing how silent failures (missing files, duplicates, stale references) accumulate over time and how to stocktake them with a checklist and a couple of shell one-liners.

Rob Bos shares a curated set of GitHub governance references he regularly sends to teams, covering enterprise platform baselines, GitHub Actions supply-chain controls, GitHub Advanced Security rollout and triage practices, and GitHub Copilot governance topics like premium requests, extension governance, and MCP-related security notes.

Hidde de Smet breaks down why spec-driven development can either reduce risk or quietly add “delivery debt”, especially in regulated environments. He outlines six common process cost centers, a three-lane model (full/light/no-spec), and a small set of KPIs to tell when structure is paying off.

Randy Pagels shares three practical habits for getting more reliable results from GitHub Copilot: start with intent, ask for multiple options, and explicitly review assumptions before accepting generated code.

Hidde de Smet explains how MCP’s Enterprise-Managed Authorization changes MCP authentication from per-server OAuth consent to policy-driven sign-in via an identity provider, with VS Code 1.123 preview support for Entra ID, Okta, and Auth0 and governance controls that pair with GitHub Copilot’s MCP registry policies.

John Edward introduces the GitHub Copilot Desktop App and explains how it extends Copilot beyond the IDE into a standalone workspace for understanding repositories, planning work, and getting AI help across day-to-day development tasks.