May 2026 Newsletter

[briancl2]

May 2026 GitHub Customer Newsletter

This is a personally curated newsletter for my customers, focused on the most relevant GitHub updates and resources this month. The May issue leads with the June 1 GitHub Copilot usage-based billing transition, then moves into cost-aware developer guidance, Copilot platform updates, governance and security items, and a short list of upcoming training and events. If you have feedback or want to dive deeper into any topic, please let me know. Feel free to share this newsletter with your team. You can find an archive of past newsletters here.

Executive Summary

• GitHub Copilot usage-based billing starts June 1 for affected customers, with metered interactions converted into GitHub AI Credits.
• Admins should set user-level budgets, identify power users, configure cost-center and enterprise spending limits, assign alert owners, and review usage weekly during rollout.
• Developers should know actual model costs, the new intent detection just launched in Auto mode, and that code completions and Next Edit Suggestions consume zero AI Credits.
• Copilot CLI (GA), the GitHub Copilot App (PREVIEW), VS Code agent features, and cross-IDE updates are expanding agent workflows across more surfaces, which increases the need for consistent policy, observability, and developer guidance.

Table of Contents

• UBB Readiness and Cost-Aware Copilot Usage
• Copilot Updates
• Governance, Reporting, and Security Updates
• GitHub Platform Updates
• Resources and Best Practices
• Webinars, Events, and Recordings

---

UBB Readiness and Cost-Aware Copilot Usage

The theme this month is operating readiness. Usage-based billing starts June 1, so the work now is budget setup, user guidance, model policy, reporting access, and a support path for teams whose agentic usage grows quickly.

New definitions: UBB means usage-based billing; AI Credits are GitHub's billing unit for metered Copilot usage where applicable; ULB means user-level budget; pooled credits are included monthly AI Credits shared across licensed users in the billing entity; additional spend means metered charges after included pooled credits are exhausted.

Action Required Now: UBB Readiness

Owner	Action	Why it matters	Source
Enterprise owner or billing manager	Set a universal user-level budget.	ULBs cap each user's AI Credit usage across pooled credits and additional metered usage, helping prevent a small number of users or sessions from consuming the shared pool early.	Budget controls
Billing manager	Identify power users and define individual overrides.	Developers running frequent agent sessions, large-codebase work, code review, or frontier-model workflows may need a higher limit to avoid blocking productive work.	Budget optimization
Billing manager and cost owners	Configure cost-center and enterprise spending limits.	These controls manage additional spend exposure after included pooled credits are exhausted, and the most restrictive applicable budget can block usage.	Managing AI credits
Billing manager	Decide where hard stops and alert recipients belong.	Spending limits without stop-usage enforcement may only alert; alert ownership determines who responds when thresholds are reached.	Budget controls
Platform owner	Publish developer usage guidance before enforcement.	Budget controls limit runaway consumption, but efficient work comes from clearer tasks, scoped context, model-to-task matching, and validation gates.	Optimize AI usage
FinOps or platform owner	Review usage exports and reports weekly during rollout, then monthly once stable.	Usage exports, team metrics, and CLI activity metrics help identify concentrated consumption, premium-model concentration, temporary spikes, and users blocked before completing useful work.	April reports

Related webinar recordings: Understanding Budgets Webinar | Token Optimization Webinar

Developer Playbook: Cost-Aware Copilot Usage

• Developer billing clarifications -- Code completions and Next Edit Suggestions are not billed in AI Credits for paid Copilot plans. UBB attention should focus on chat, agents, premium models, large-context work, repeated sessions, and Copilot code review. Code review is a separate tracking surface because token consumption is billed in AI Credits and the agentic infrastructure consumes GitHub Actions minutes. - Models and Pricing | Code Review Docs

• Feature-specific token and context controls -- Auto model selection, prompt caching, tool search, agentic search and execution tools, OpenTelemetry tracing for agent sessions, model details in agent responses, terminal output compression, reasoning controls, and Copilot SDK OpenTelemetry all help teams understand, manage, or control context and token usage. Treat those signals as engineering input before writing policy. - Token Efficiency Notes | Agent Observability Notes | Terminal Controls Notes

• Workflow design beats blunt output limits -- Useful agent work gets cheaper through better routes, not just shorter prompts. Start with clear tasks and stopping conditions, split larger work into research, plan, implementation, and validation phases, use the smallest capable model for the phase, and keep deterministic guardrails in the loop. - Optimize AI Usage | VS Code Harness Blog

• Measure before policy -- Usage reports, team metrics, CLI metrics, and OpenTelemetry can all provide engineering signals. Treat metrics as engineering evidence, not invoices, durable savings proof, or model-superiority evidence. - Copilot Usage Metrics API | OpenTelemetry Docs

May cost optimization bundle -- Like February's Co-launch where I open-sourced my newsletter generation system, I used May's newsletter creation process to learn real world do's and don'ts for agentic workflow cost optimization. I packaged the evidence and source notes behind my process into a Cost Optimization Guide along with a technical deep dive on exactly what changed in the workflow at Technical Deep Dive

The results show about a 25-50% reduction in actual tokens per run that translate to a $6-12 per run cost reduction. It shows the practical learning process behind the guidance, including the quality gates that kept the evidence honest and the things that did not work. Use it as a real world cost optimization example. Included in the release bundle are links to other first-party cost optimization guides, and release notes for enhancements to the newsletter generation system.

The most humbling finding is that the cheapest or shortest prompt is rarely the cheapest workflow. Most of the savings came from making the system stop repeating work, not from asking for shorter responses. If you are a developer or otherwise responsible for AI costs, that is the lever I would reach for first

---

Copilot

Latest Releases

Copilot capabilities are expanding across IDE, CLI, GitHub.com, app, and mobile surfaces. The operational question for enterprise teams is how to keep model policy, observability, tool permissions, and user guidance consistent as agent work spreads across those surfaces.

Selected feature recordings: GitHub Copilot App Video (5m) | Copilot CLI Rubber Duck Video (5m) | Hooks Video (20m) | Copilot CLI Build Video (5m)

• Copilot CLI operational themes -- Copilot CLI is moving from terminal helper to governed agent runtime. Key themes this month are session control with remote control (GA) through /remote on, --remote, and /keep-alive; autonomy controls with --mode, --autopilot, and --plan plus /autopilot; workflow reuse with copilot plugin marketplace update and /skills; policy hooks such as HTTP hooks and preMcpToolCall; MCP integration through copilot mcp and /mcp search; and history, memory, model, and cost signals through /chronicle search, /memory show, and auto model selection. - Copilot CLI Releases

• GitHub Copilot app (PREVIEW) -- The GitHub Copilot app brings GitHub-native agent work into a focused desktop workflow. It starts from GitHub context, keeps work in focused sessions, supports review of plans, diffs, comments, checks, pull request creation, and merge requirements, provides Agent Merge follow-through, includes integrated terminal and browser testing, and turns skills and prompts into workflows. Recommended action: pilot with preview controls enabled, verify policy requirements, and share real world feedback before general availability. - Changelog | Preview Terms

• Model availability updates (GA) -- GPT-5.4, GPT-5.5, Claude Opus 4.8, Gemini 3.5 Flash, and GPT-5.3-Codex are listed as GA in current Copilot model references. Availability can still depend on plan, model policy, rollout timing, client surface, and minimum IDE or extension versions. - GPT-5.4 | GPT-5.5 | Gemini 3.5 Flash | Supported Models

• Copilot Memory, SDK, Spaces, and observability -- Copilot Memory (PREVIEW) gained controls for deletion, scope, and CLI support; Copilot SDK is PREVIEW; Copilot Spaces API is GA; and SDK OpenTelemetry docs show how instrumented SDK applications can collect traces and propagate W3C trace context. Recommended action: use GitHub usage reports and IDE/CLI telemetry first for standard usage, then add SDK/OpenTelemetry where your team owns the agent harness. - SDK Preview | Spaces API

• Copilot on GitHub.com and pull requests -- GitHub.com added Copilot repository exploration, pull request change requests, merge conflict help, web debugging, semantic issue search (GA), and agent session management from issues and projects. Recommended action: decide which collaboration surfaces are awareness-only for now and which should be included in rollout guidance. - Explore Repository | PR Changes | Merge Conflicts | Semantic Issue Search

VS Code is the coordination hub for agentic development. The recent releases clusters around agent windows, remote agents, CLI session continuity, observability, token efficiency, provider controls, sandboxing, and reusable customization.

Selected VS Code recordings: Remote Sessions Video (5m) | Chronicle Video (5m) | Agent Plugins Video (5m)

• VS Code agent workflow surface (PREVIEW) -- The Agents window, remote agents, Agent Host Protocol work, chat-session handoff, and richer session management make parallel or remote sessions trackable work instead of hidden background prompts. - Agent Host | Session Management | Latest Release | Video (5m)

• VS Code CLI continuity and observability -- VS Code expanded Copilot CLI oversight with background agents, steering, permission levels, MCP bridging, session forking, debug logs, remote control, plan controls, terminal output compression, prompt caching, tool search, and reasoning controls. Recommended action: use these as engineering signals and guardrails to learn about cost. - Agent Sessions | Permissions | MCP Bridge | Session Forking | Debug Logs | Tool Search | Plan Controls | Reasoning Controls | Skills Context

• Provider choice, sandboxing, and customization controls -- BYOK for Copilot Business and Enterprise in VS Code, provider-grouped model picker, terminal sandboxing, local MCP server sandboxing, network-domain group policy, approved-account policy, sensitive terminal prompt handling, command risk assessment, agent plugins, and customization diagnostics give platform teams clearer workspace, network, provider, and instruction boundaries. - Policy Controls | Security Prompts

IDE Parity

Agent capability rollouts are increasingly feature-centric rather than IDE-centric. The practical customer action is to verify minimum versions and policy requirements before promising parity to teams.

• VS Code -- Still the broadest coordination surface for agent workflows, with Agents window (PREVIEW), remote agents (PREVIEW), session management, MCP bridging, debugging, OpenTelemetry, BYOK, sandboxing, tool search, and customization controls. - VS Code Updates | Latest Release Notes

• Visual Studio -- Continues custom agents, skills, cloud sessions, debugger/profiling/testing agents, and modernization agents, especially for .NET, C++, and enterprise Visual Studio teams. - Visual Studio Release Notes

• JetBrains IDEs -- Adds custom agents (GA), subagents (GA), Plan agent (GA), agent skills/hooks/prompt files (GA), auto model selection (GA), inline agent mode, Copilot CLI agent, unified sessions, MCP allowlist controls, and global instruction file support. - JetBrains Plugin

• Xcode -- Includes BYOK (GA), custom agents (GA), Auto model selection (GA), reasoning controls, context-window token breakdowns, and Auto Compress for Apple-platform teams. - Xcode Releases

• Eclipse -- The Copilot for Eclipse plugin is now open source and includes chat, agent mode, skills, prompt files, BYOK, custom agents, isolated subagents, Plan agent, and MCP integration. - Eclipse Marketplace

Note: Copilot features often start in VS Code, then roll out across Visual Studio and JetBrains IDEs, followed by Eclipse and Xcode. Labels, policies, and minimum versions can vary by client.

Stay current with the latest changes: Copilot Feature Matrix | GitHub Copilot Changelog | VS Code Release Notes | Visual Studio Release Notes | JetBrains Plugin | Xcode Releases | Eclipse Marketplace | Copilot CLI Releases | GitHub Previews | Preview Terms Changelog

---

Governance, Reporting, and Security Updates

• Copilot governance, metrics, and auditability -- Plan-mode metrics, CLI activity, team-level API access, GitHub-owned report URLs, AI adoption cohorts, and cloud-agent configuration audit APIs (PREVIEW) can give admins a practical evidence layer for rollout, compliance reporting, and UBB readiness. - Plan Mode Metrics | CLI Metrics | Team Metrics | Report URLs | Audit API

• Copilot cloud agent controls -- Organization runner controls, firewall settings, custom property enablement, custom images, faster validation tools, REST task start APIs (PREVIEW), and more flexible secrets/variables make cloud-agent rollout more governable. Recommended action: decide where cloud agents can run, which networks they can reach, and which repositories can enable them. - Runner Controls | Firewall Settings | Custom Properties | REST API | Secrets

• GitHub Enterprise Server signing key rotation -- GHES administrators need to rotate GPG public keys using GitHub's provided script before installing future patches and releases signed with the new key. No action is required for GitHub Enterprise Cloud. Recommended action: review the rotation instructions and schedule this with your GHES maintenance owners. - GitHub Blog

• MCP security, code-to-cloud visibility, and GHAS budgets -- Secret scanning through GitHub MCP Server is GA, dependency scanning through MCP is PREVIEW, Microsoft Defender for Cloud code-to-cloud risk visibility is GA, the Code Security Risk Assessment gives organization admins a no-cost CodeQL scan of active repositories, and GHAS hard budget limits add enforceable license caps and cost-center controls for security spend. - Secret Scanning MCP | Dependency Scanning MCP | Defender | GHAS Trial

• Deprecations and Migration Notices -- Plan once for older Copilot model retirements, Grok Code Fast 1 retirement, Python 3.9 for Dependabot, synchronous SBOM API deprecation, code_scanning_upload rate limit API removal, and the upcoming GitHub App installation token format change. - Supported Models | Dependabot Python | SBOM API | Rate Limit API | App Tokens

---

GitHub Platform Updates

• GitHub Code Quality and code coverage (PREVIEW) -- GitHub Code Quality standard findings, the repository enablement API, and code coverage on pull requests are in PREVIEW. Customer action: awareness now, pilot where code-quality gates are already part of PR policy.

• Enterprise administration, supply chain, and Actions updates -- Platform updates include EU data residency expansion to EFTA, enterprise installation APIs (PREVIEW), Enterprise Live Migrations (PREVIEW), commit-comment controls, repository ruleset improvements, npm staged publishing (GA) and install-time controls, expanded OIDC (GA on github.com; GHES 3.22 planned), org-level private registries, async SBOM exports, and custom images for GitHub-hosted runners (GA). - EU Data Residency | Private Registries

---

Resources and Best Practices

• Agent harness and evaluation thinking -- The VS Code harness blog explains why agent quality depends on context assembly, tool exposure, loop control, provider-specific harness behavior, and product-specific evaluation, not the model alone. - VS Code Harness Blog

• Security incident response reference -- GitHub Docs now has a security incident response reference for investigation tools and common incident investigation areas across GitHub. - Docs

• GitHub Certified: Agentic AI Developer -- The GH-600 beta exam focuses on operating AI agents safely: tool permissions, environments, memory/state, evaluation, multi-agent workflows, guardrails, and human-in-the-loop systems. - Microsoft Tech Community

---

Webinars, Events, and Recordings

• GitHub Copilot YouTube playlist
• GitHub Advanced Security playlist

Recommended

• Budget controls webinar recording: for admins, billing managers, and FinOps partners. - Watch
• Token optimization webinar recording: for platform teams and developer leads. - Watch
• GitHub Certified: Agentic AI Developer resources: for enablement leads planning agent training. - Resources

Microsoft Build 2026: GitHub and Copilot Session Guide

Microsoft Build runs June 2-3 in San Francisco and online. The GitHub-filtered online catalog has a large set of sessions; these are the most relevant for Copilot, GitHub platform, agent workflows, and enterprise rollout.

Date	Time (CT)	Session	Categories
Jun 2	11:30 AM - 2:00 PM	Microsoft Build opening keynote	Keynote, AI
Jun 2	4:30 PM - 5:15 PM	Your agent, anywhere: MultiClient, MultiDevice with GitHub Copilot SDK	Copilot, Developer Experience
Jun 3	11:00 AM - 11:45 AM	From CLI to PR: Automating the path to merged code	Copilot, Developer Experience
Jun 3	12:55 PM - 1:15 PM	New coding models optimized for GitHub Copilot	Copilot, Developer Experience
Jun 3	2:30 PM - 2:45 PM	From issue to merge in one loop: the GitHub Copilot app	Copilot, Developer Experience
Jun 3	6:00 PM - 6:45 PM	GitHub Copilot in Visual Studio: Agents That Debug, Profile, and Test	Copilot, Developer Experience

The full GitHub online session catalog also includes digital labs for GitHub Actions supply chain risk, Copilot custom tools/context/workflows, Copilot CLI live coding, and agent deployment on Azure.

Virtual Events

Date	Event	Categories
Jun 5	GitHub Copilot Webinar: Agent Quality & Token Optimisation	Copilot, Developer Experience
Jun 12	DevOps Foundations for the AI Agentic Era	Developer Experience
Jun 18	GitHub Q2 Roadmap Webinar	Copilot, Enterprise
Jun 24	Copilot in action: Best practices and use cases for teams	Copilot, Developer Experience

Training and In-Person Events

Date	Event	Categories
Jun 2-3	Microsoft Build 2026, San Francisco and online	Copilot, GitHub Platform
Jun 1	GitHub Social Club at Microsoft Build, San Francisco	GitHub Community
Jun 3	OpenClaw: After Hours at GitHub, GitHub HQ	Developer Experience
Jun 4	Beyond Build: AI Developer Day, GitHub HQ	Developer Experience
Jun 8-12	Microsoft AI Skills Fest	Developer Experience

Official Microsoft Learn Training (Free)

Official instructor-led video courses from Microsoft Learn, available free on YouTube. These are useful for structured team onboarding, certification preparation, and self-paced upskilling.

Course	Episodes	Total Length	Level	Playlist
GH-900: GitHub Foundations	Course preview + 9 episodes: Version Control (44m), GitHub (45m), GitHub Products (21m), Open Source (32m), Markdown (21m), Projects (23m), Codespaces (21m), Security (42m), Copilot (31m)	~4h 41m	Beginner	Watch
GH-300: GitHub Copilot	Course preview + 5 episodes: Introduction (41m), Exploring Features (1h15m), Generative AI Use Cases (42m), Writing Unit Tests (20m), Advanced Features (59m)	~3h 57m	Intermediate	Watch
AZ-2007: Accelerate app development by using GitHub Copilot	5 episodes: Get Started (30m), Documentation (42m), Code Features (49m), Unit Tests (35m), Code Improvements (42m)	~3h 17m	Intermediate	Watch
GH-500: GitHub Advanced Security	Course preview + 5 episodes: Introduction to GHAS (36m), Sensitive Data and Security Policies (40m), Dependabot Security Updates (28m), Secret Scanning (12m), Code Scanning (39m)	~2h 35m	Intermediate	Watch
GH-200: Automate your workflow with GitHub Actions	5 episodes: Course Introduction (5m), Intro to Actions (48m), Pipelines in Actions (1h7m), Extending Workflows (55m), Org and Enterprise Config (44m)	~3h 39m	Beginner	Watch
AZ-2008: DevOps Foundations: The Core Principles and Practices	6 episodes: Core Principles (3m), Discover DevOps (12m), Plan (20m), Develop (25m), Deliver (20m), Operate (24m)	~1h 44m	Beginner	Watch

---

Closing

If you have any questions or want to discuss these updates in detail, feel free to reach out. As always, I'm here to help you and your team stay informed and get the most value from GitHub. I welcome your feedback, and please let me know if you would like to add or remove anyone from this list.