diff --git a/CHANGELOG.md b/CHANGELOG.md index ae7dafe8c72e..2ea2f683230c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,112 @@ # Docs changelog +**31 October 2025** + +A large amount of new information was added to the GitHub documentation website to coincide with the GitHub Universe 2025 conference. Here are links to some of the new and updated articles. + +**_New articles_** + +GitHub Copilot documentation: +* [Setting up a dedicated enterprise for GitHub Copilot Business](https://docs.github.com/copilot/how-tos/set-up/set-up-a-dedicated-enterprise-for-copilot-business) +* [About Copilot integrations](https://docs.github.com/copilot/concepts/tools/about-copilot-integrations) +* [Integrating Copilot coding agent with Linear](https://docs.github.com/copilot/how-tos/use-copilot-agents/coding-agent/integrate-coding-agent-with-linear) +* [Integrating Copilot coding agent with Slack](https://docs.github.com/copilot/how-tos/use-copilot-agents/coding-agent/integrate-coding-agent-with-slack) +* [Changing your MCP registry in your IDE](https://docs.github.com/copilot/how-tos/provide-context/use-mcp/change-mcp-registry) +* [GitHub Copilot usage metrics](https://docs.github.com/copilot/concepts/copilot-metrics) +* [Viewing the Copilot usage metrics dashboard](https://docs.github.com/copilot/how-tos/administer-copilot/manage-for-enterprise/view-usage-and-adoption) +* [Data available in Copilot usage metrics](https://docs.github.com/copilot/reference/copilot-usage-metrics/copilot-usage-metrics) +* [Interpreting usage and adoption metrics for GitHub Copilot](https://docs.github.com/copilot/reference/copilot-usage-metrics/interpret-copilot-metrics) +* [Reconciling Copilot usage metrics across dashboards, APIs, and reports](https://docs.github.com/copilot/reference/copilot-usage-metrics/reconciling-usage-metrics) +* [Tracking license activation and initial usage with Copilot usage metrics](https://docs.github.com/copilot/tutorials/roll-out-at-scale/assign-licenses/track-usage-and-adoption) +* [Lines of Code metrics](https://docs.github.com/copilot/reference/copilot-usage-metrics/lines-of-code-metrics) +* [Measuring the success of a GitHub Copilot trial](https://docs.github.com/copilot/tutorials/roll-out-at-scale/measure-success) +* [About custom agents](https://docs.github.com/copilot/concepts/agents/coding-agent/about-custom-agents) +* [Creating custom agents](https://docs.github.com/copilot/how-tos/use-copilot-agents/coding-agent/create-custom-agents) +* [Custom agents configuration](https://docs.github.com/copilot/reference/custom-agents-configuration) +* [Custom agents: Bug fix teammate](https://docs.github.com/copilot/tutorials/customization-library/custom-agents/bug-fix-teammate) +* [Custom agents: Cleanup specialist](https://docs.github.com/copilot/tutorials/customization-library/custom-agents/cleanup-specialist) +* [Custom agents: Implementation planner](https://docs.github.com/copilot/tutorials/customization-library/custom-agents/implementation-planner) +* [Your first custom agent](https://docs.github.com/copilot/tutorials/customization-library/custom-agents/your-first-custom-agent) +* [Agent management for enterprises](https://docs.github.com/copilot/concepts/agents/enterprise-management) +* [Monitoring agentic activity in your enterprise](https://docs.github.com/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/monitor-agentic-activity) +* [Preparing to use custom agents in your enterprise](https://docs.github.com/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/prepare-for-custom-agents) +* [Preparing to use custom agents in your organization](https://docs.github.com/copilot/how-tos/administer-copilot/manage-for-organization/prepare-for-custom-agents) +* [Audit log events for agents](https://docs.github.com/copilot/reference/agentic-audit-log-events) +* [About agent management](https://docs.github.com/copilot/concepts/agents/coding-agent/agent-management) +* [Managing Copilot coding agents](https://docs.github.com/copilot/how-tos/use-copilot-agents/manage-agents) +* [OpenAI Codex](https://docs.github.com/copilot/concepts/agents/openai-codex) + +Security and code quality documentation: +* [Enabling extended metadata checks for your repository](https://docs.github.com/code-security/secret-scanning/enabling-secret-scanning-features/enabling-extended-metadata-checks-for-your-repository) +* [About GitHub Code Quality](https://docs.github.com/code-security/code-quality/concepts/about-code-quality) +* [Quickstart for GitHub Code Quality](https://docs.github.com/code-security/code-quality/get-started/quickstart) +* [Allowing use of GitHub Code Quality in your enterprise](https://docs.github.com/code-security/code-quality/how-tos/allow-in-enterprise) +* [Enabling GitHub Code Quality](https://docs.github.com/code-security/code-quality/how-tos/enable-code-quality) +* [Interpreting the code quality results for your repository](https://docs.github.com/code-security/code-quality/how-tos/interpret-results) +* [Setting code quality thresholds for pull requests](https://docs.github.com/code-security/code-quality/how-tos/set-pr-thresholds) +* [Resolving a block on your pull request](https://docs.github.com/code-security/code-quality/how-tos/unblock-your-pr) +* [CodeQL detection of code quality problems](https://docs.github.com/code-security/code-quality/reference/codeql-detection) +* [Metrics and ratings reference](https://docs.github.com/code-security/code-quality/reference/metrics-and-ratings) +* [Responsible use of GitHub Code Quality](https://docs.github.com/code-security/code-quality/responsible-use/code-quality) +* [Fixing code quality findings before merging your pull request](https://docs.github.com/code-security/code-quality/tutorials/fix-findings-in-prs) +* [Improving the quality of recently merged code with AI](https://docs.github.com/code-security/code-quality/tutorials/improve-recent-merges) +* [Improving the quality of your repository's code](https://docs.github.com/code-security/code-quality/tutorials/improve-your-codebase) + +GitHub integrations: +* [Customizing notifications for GitHub in Slack](https://docs.github.com/integrations/how-tos/slack/customize-notifications) +* [Integrating GitHub with Slack](https://docs.github.com/integrations/how-tos/slack/integrate-github-with-slack) +* [Using GitHub in Slack](https://docs.github.com/integrations/how-tos/slack/use-github-in-slack) +* [Permissions for GitHub in Slack](https://docs.github.com/integrations/reference/slack-permissions) +* [Creating issues with the GitHub integration in Slack](https://docs.github.com/integrations/tutorials/slack/create-issues) +* [Managing issues with the GitHub integration in Slack](https://docs.github.com/integrations/tutorials/slack/manage-issues) + +GitHub Actions: +* [Using custom images](https://docs.github.com/actions/how-tos/manage-runners/larger-runners/use-custom-images) +* [Using proxy servers with a runner](https://docs.github.com/actions/how-tos/manage-runners/use-proxy-servers) + +Enterprise administrator documentation: +* [Custom properties](https://docs.github.com/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/custom-properties) +* [Managing custom properties for organizations](https://docs.github.com/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organizations) +* [Controlling user offboarding with the unaffiliated users policy](https://docs.github.com/admin/enforcing-policies/enforcing-policies-for-your-enterprise/control-offboarding) + +Enterprise onboarding: +* [Adding users to your enterprise](https://docs.github.com/enterprise-onboarding/getting-started-with-your-enterprise/adding-users-to-your-enterprise) +* [Creating enterprise apps](https://docs.github.com/enterprise-onboarding/github-apps/create-enterprise-apps) +* [Installing enterprise apps](https://docs.github.com/enterprise-onboarding/github-apps/install-enterprise-apps) +* [About enterprise policies](https://docs.github.com/enterprise-onboarding/govern-people-and-repositories/about-enterprise-policies) +* [Creating custom properties for repositories in your enterprise](https://docs.github.com/enterprise-onboarding/govern-people-and-repositories/create-custom-properties) +* [Defining policies for repositories in your enterprise](https://docs.github.com/enterprise-onboarding/govern-people-and-repositories/create-repository-policies) +* [Protecting branches in your enterprise with rulesets](https://docs.github.com/enterprise-onboarding/govern-people-and-repositories/protect-branches) +* [Using the audit log for your enterprise](https://docs.github.com/enterprise-onboarding/govern-people-and-repositories/using-the-audit-log-for-your-enterprise) +* [About roles in an enterprise](https://docs.github.com/enterprise-onboarding/setting-up-organizations-and-teams/about-roles-in-an-enterprise) +* [About teams in an enterprise](https://docs.github.com/enterprise-onboarding/setting-up-organizations-and-teams/about-teams-in-an-enterprise) +* [Assigning roles to teams and users](https://docs.github.com/enterprise-onboarding/setting-up-organizations-and-teams/assigning-roles-to-teams-and-users) +* [Best practices for organizing work in your enterprise](https://docs.github.com/enterprise-onboarding/setting-up-organizations-and-teams/best-practices) +* [Creating custom roles](https://docs.github.com/enterprise-onboarding/setting-up-organizations-and-teams/creating-custom-roles) +* [Identifying the roles required by your enterprise](https://docs.github.com/enterprise-onboarding/setting-up-organizations-and-teams/identify-role-requirements) + +Billing documentation: +* [GitHub Code Quality billing](https://docs.github.com/billing/concepts/product-billing/github-code-quality) + +**_Updated articles_** + +This is just a very small selection of the articles that were updated for Universe 2025. + +* [About GitHub Copilot code review](https://docs.github.com/copilot/concepts/agents/code-review) - new conceptual information. +* [Fixing alerts in a security campaign](https://docs.github.com/code-security/code-scanning/managing-code-scanning-alerts/fixing-alerts-in-security-campaign) - new information on assigning alerts to Copilot coding agent. +* [Resolving code scanning alerts](https://docs.github.com/code-security/code-scanning/managing-code-scanning-alerts/resolving-code-scanning-alerts) - new information on assigning alerts to Copilot coding agent. +* [Available rules for rulesets](https://docs.github.com/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets) - new information on blocking force pushes. +* [GitHub-hosted runners reference](https://docs.github.com/actions/reference/runners/github-hosted-runners) - new information about single-CPU Actions runners. +* [Events that trigger workflows](https://docs.github.com/actions/reference/workflows-and-actions/events-that-trigger-workflows) - details of `image_version_ready` event added. +* [Enforcing policies for GitHub Actions in your enterprise](https://docs.github.com/admin/enforcing-policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise) - details about custom images added. +* [Model Context Protocol (MCP) and GitHub Copilot coding agent](https://docs.github.com/copilot/concepts/agents/coding-agent/mcp-and-coding-agent) - new information about MCP servers for custom agents. +* [Best practices for using GitHub Copilot to work on tasks](https://docs.github.com/copilot/tutorials/coding-agent/get-the-best-results) - new information about creating custom agents. +* [Quickstart for your personal dashboard](https://docs.github.com/account-and-profile/get-started/personal-dashboard-quickstart) - added a section on working with Copilot from your personal dashboard. +* [Personal dashboard](https://docs.github.com/account-and-profile/reference/personal-dashboard) - added a section on the home dashboard view. +* [Using GitHub Copilot CLI](https://docs.github.com/copilot/how-tos/use-copilot-agents/use-copilot-cli) - new information on delegating tasks to Copilot coding agent. + +
+ **24 October 2025** To support the enterprise roles and teams public preview, we: diff --git a/content/copilot/concepts/agents/coding-agent/about-coding-agent.md b/content/copilot/concepts/agents/coding-agent/about-coding-agent.md index 10bd9da4a7b2..fd7665048977 100644 --- a/content/copilot/concepts/agents/coding-agent/about-coding-agent.md +++ b/content/copilot/concepts/agents/coding-agent/about-coding-agent.md @@ -25,7 +25,7 @@ category: With {% data variables.copilot.copilot_coding_agent %}, {% data variables.product.prodname_copilot %} can work independently in the background to complete tasks, just like a human developer. -{% data variables.product.prodname_copilot_short %} can: +{% data variables.copilot.copilot_coding_agent %} can: * Fix bugs * Implement incremental new features @@ -33,15 +33,15 @@ With {% data variables.copilot.copilot_coding_agent %}, {% data variables.produc * Update documentation * Address technical debt -To delegate tasks to {% data variables.product.prodname_copilot_short %}, you can: +To delegate tasks to {% data variables.copilot.copilot_coding_agent %}, you can: * Ask Copilot to open a new pull request from many places, including {% data variables.product.prodname_github_issues %}, {% data variables.product.prodname_vscode %} and the agents panel available on every page on {% data variables.product.github %}. See [AUTOTITLE](/copilot/how-tos/use-copilot-agents/coding-agent/create-a-pr). * Mention `@copilot` in a comment on an existing pull request to ask it to make changes. See [AUTOTITLE](/copilot/how-tos/use-copilot-agents/coding-agent/make-changes-to-an-existing-pr). {% ifversion security-campaigns-assign-to-cca %}* Assign security alerts to {% data variables.product.prodname_copilot_short %} from security campaigns. See [AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/fixing-alerts-in-security-campaign#assigning-alerts-to-copilot-coding-agent).{% endif %} -{% data variables.product.prodname_copilot_short %} will evaluate the task it has been assigned based on the prompt you give it—whether that's from the issue description or a chat message. Then {% data variables.product.prodname_copilot_short %} will make the required changes and open a pull request. When {% data variables.product.prodname_copilot_short %} finishes, it will request a review from you, and you can leave pull request comments to ask {% data variables.product.prodname_copilot_short %} to iterate. +{% data variables.copilot.copilot_coding_agent %} will evaluate the task it has been assigned based on the prompt you give it—whether that's from the issue description or a chat message. Then {% data variables.copilot.copilot_coding_agent %} will make the required changes and open a pull request. When {% data variables.copilot.copilot_coding_agent %} finishes, it will request a review from you, and you can leave pull request comments to ask {% data variables.copilot.copilot_coding_agent %} to iterate. -While working on a coding task, {% data variables.product.prodname_copilot_short %} has access to its own ephemeral development environment, powered by {% data variables.product.prodname_actions %}, where it can explore your code, make changes, execute automated tests and linters and more. +While working on a coding task, {% data variables.copilot.copilot_coding_agent %} has access to its own ephemeral development environment, powered by {% data variables.product.prodname_actions %}, where it can explore your code, make changes, execute automated tests and linters and more. You can also create {% data variables.copilot.custom_agents_short %} to tailor {% data variables.product.prodname_copilot_short %}'s behavior for specific workflows, coding conventions, or specialized tasks. {% data variables.copilot.custom_agents_caps_short %} allow you to define multiple specialized versions of the coding agent—such as a frontend reviewer, test generator, or security auditor—each with their own prompts, tools, and capabilities. For more information, see [AUTOTITLE](/copilot/concepts/agents/coding-agent/about-custom-agents). @@ -59,13 +59,13 @@ When used effectively, {% data variables.copilot.copilot_coding_agent %} offers ### Streamlining software development with {% data variables.copilot.copilot_coding_agent %} -Assigning tasks to {% data variables.product.prodname_copilot_short %} can enhance your software development workflow. +Assigning tasks to {% data variables.copilot.copilot_coding_agent %} can enhance your software development workflow. -For example, you can assign {% data variables.product.prodname_copilot_short %} to straightforward issues on your backlog. This allows you to spend less time on these and more time on more complex or interesting work, or work that requires a high degree of creative thinking. {% data variables.product.prodname_copilot_short %} can work on "nice to have" issues that improve the quality of your codebase or product, but often remain on the backlog while you focus on more urgent work. +For example, you can assign {% data variables.copilot.copilot_coding_agent %} to straightforward issues on your backlog by selecting "{% data variables.product.prodname_copilot_short %}" as the assignee. This allows you to spend less time on these issues and more time on more complex or interesting work, or work that requires a high degree of creative thinking. {% data variables.copilot.copilot_coding_agent %} can work on "nice to have" issues that improve the quality of your codebase or product, but often remain on the backlog while you focus on more urgent work. -Having {% data variables.product.prodname_copilot_short %} as an additional coding resource also allows you to start tasks that you might not have otherwise due to lack of resources. For example, you might delegate {% data variables.product.prodname_copilot_short %} tasks to refactor code or add more logging, then immediately assign these to {% data variables.product.prodname_copilot_short %}. +Having {% data variables.copilot.copilot_coding_agent %} as an additional coding resource also allows you to start tasks that you might not have otherwise started due to lack of resources. For example, you might create issues to refactor code or add more logging, and then immediately assign these to {% data variables.product.prodname_copilot_short %}. -{% data variables.product.prodname_copilot_short %} can start a task, which you then pick up and continue working on yourself. By assigning the initial work to {% data variables.product.prodname_copilot_short %}, you free up time that you would otherwise have spent doing repetitive tasks, such as setting up the scaffolding for a new project. +{% data variables.copilot.copilot_coding_agent %} can start a task, which you then pick up and continue working on yourself. By assigning the initial work to {% data variables.product.prodname_copilot_short %}, you free up time that you would otherwise have spent doing repetitive tasks, such as setting up the scaffolding for a new project. You can create specialized {% data variables.copilot.custom_agents_short %} for different tasks. For example, you might create a {% data variables.copilot.copilot_custom_agent_short %} specialized for frontend development that focuses on React components and styling, a documentation agent that excels at writing and updating technical documentation, or a testing agent that specializes in generating comprehensive unit tests. Each {% data variables.copilot.copilot_custom_agent_short %} can be tailored with specific prompts and tools suited to its particular task. @@ -89,13 +89,13 @@ For more information, see [AUTOTITLE](/copilot/concepts/agents/coding-agent/mana {% data variables.copilot.copilot_coding_agent %} uses {% data variables.product.prodname_actions %} minutes and {% data variables.product.prodname_copilot_short %} premium requests. -Within your monthly usage allowance for {% data variables.product.prodname_actions %} and premium requests, you can ask {% data variables.product.prodname_copilot_short %} to work on coding tasks without incurring any additional costs. +Within your monthly usage allowance for {% data variables.product.prodname_actions %} and premium requests, you can ask {% data variables.copilot.copilot_coding_agent %} to work on coding tasks without incurring any additional costs. For more information, see [AUTOTITLE](/billing/managing-billing-for-your-products/managing-billing-for-github-copilot/about-billing-for-github-copilot#allowance-usage-for-copilot-coding-agent). ## Built-in security protections -Security is a fundamental consideration when you enable {% data variables.copilot.copilot_coding_agent %}, as with any other AI agent. {% data variables.product.prodname_copilot_short %} has a strong base of built-in security protections that you can supplement by following best practice guidance. +Security is a fundamental consideration when you enable {% data variables.copilot.copilot_coding_agent %}, as with any other AI agent. {% data variables.copilot.copilot_coding_agent %} has a strong base of built-in security protections that you can supplement by following best practice guidance. * **Validated for security issues**: {% data variables.product.prodname_copilot_short %} analyzes the code created by {% data variables.copilot.copilot_coding_agent %} for security issues and attempts to resolve them prior to completing the pull request. This reduces the likelihood of the code generated by {% data variables.copilot.copilot_coding_agent %} introducing problems such as hardcoded secrets, insecure dependencies, and other vulnerabilities. Details about the analysis performed and the actions taken by {% data variables.copilot.copilot_coding_agent %} can be reviewed in the session log. See [AUTOTITLE](/copilot/how-tos/use-copilot-agents/coding-agent/track-copilot-sessions). * **{% data variables.product.prodname_codeql %}** is used to identify code security issues. @@ -103,11 +103,11 @@ Security is a fundamental consideration when you enable {% data variables.copilo * **{% data variables.product.prodname_secret_scanning_caps %}** is used to detect sensitive information such as API keys, tokens, and other secrets. * {% data variables.copilot.copilot_coding_agent %}'s security validation **does not require** a {% data variables.product.prodname_GHAS_cs_or_sp %} license. * **Subject to existing governance**: Organization settings and enterprise policies control availability. Any security policies and practices set up for the organization also apply to {% data variables.copilot.copilot_coding_agent %}. -* **Restricted development environment**: {% data variables.product.prodname_copilot_short %} works in a sandbox development environment with internet access controlled by a firewall. It has read-only access to the repository it's assigned to work in. -* **Limited access to branches**: {% data variables.product.prodname_copilot_short %} can only create and push to branches beginning with `copilot/`. It is subject to any branch protections and required checks for the working repository. -* **Responds only to users with write permissions**: {% data variables.product.prodname_copilot_short %} will not respond to feedback from users with lower levels of access. -* **Treated as an outside collaborator**: Draft pull requests proposed by {% data variables.product.prodname_copilot_short %} require approval by a user with write permissions before Actions workflows can run. {% data variables.product.prodname_copilot_short %} cannot mark its pull requests as "Ready for review" and cannot approve or merge a pull request. -* **Tracked for compliance**: {% data variables.product.prodname_copilot_short %}'s commits are co-authored by the developer who assigned the issue or requested the change to the pull request, allowing attribution of proposed changes. The developer who asked {% data variables.product.prodname_copilot_short %} to create a pull request cannot approve that pull request. In repositories where an approving review is required, this ensures that at least one independent developer reviews {% data variables.product.prodname_copilot_short %}'s work. +* **Restricted development environment**: {% data variables.copilot.copilot_coding_agent %} works in a sandbox development environment with internet access controlled by a firewall. It has read-only access to the repository it's assigned to work in. +* **Limited access to branches**: {% data variables.copilot.copilot_coding_agent %} can only create and push to branches beginning with `copilot/`. It is subject to any branch protections and required checks for the working repository. +* **Responds only to users with write permissions**: {% data variables.copilot.copilot_coding_agent %} will not respond to feedback from users with lower levels of access. +* **Treated as an outside collaborator**: Draft pull requests proposed by {% data variables.copilot.copilot_coding_agent %} require approval by a user with write permissions before Actions workflows can run. {% data variables.copilot.copilot_coding_agent %} cannot mark its pull requests as "Ready for review" and cannot approve or merge a pull request. +* **Tracked for compliance**: {% data variables.copilot.copilot_coding_agent %}'s commits are co-authored by the developer who assigned the issue or requested the change to the pull request, allowing attribution of proposed changes. The developer who asked {% data variables.product.prodname_copilot_short %} to create a pull request cannot approve that pull request. In repositories where an approving review is required, this ensures that at least one independent developer reviews {% data variables.copilot.copilot_coding_agent %}'s work. For more information, see: * [AUTOTITLE](/copilot/tutorials/pilot-copilot-coding-agent#2-secure) (information on how organization owners can further enhance security) @@ -118,39 +118,39 @@ For more information, see: {% data variables.copilot.copilot_coding_agent %} is an autonomous agent that has access to your code and can push changes to your repository. This entails certain risks. Where possible, {% data variables.product.github %} has applied appropriate mitigations. -### Risk: {% data variables.product.prodname_copilot_short %} can push code changes to your repository +### Risk: {% data variables.copilot.copilot_coding_agent %} can push code changes to your repository To mitigate this risk, {% data variables.product.github %}: -* **Limits who can assign tasks to {% data variables.product.prodname_copilot_short %}.** Only users with write access to the repository can trigger {% data variables.product.prodname_copilot_short %} to work. Comments from users without write access are never presented to the agent. -* **Limits the permissions in access tokens used by Copilot.** Pushes are only allowed to branches beginning with `copilot/`. {% data variables.product.prodname_copilot_short %} cannot push to the `main` or `master` branches. -* **Limits {% data variables.product.prodname_copilot_short %}'s credentials.** {% data variables.product.prodname_copilot_short %} can only perform simple push operations. It cannot directly run `git push` or other Git commands. -* **Restricts {% data variables.product.prodname_actions %} workflow runs.** Workflows are not triggered until {% data variables.product.prodname_copilot_short %}'s code is reviewed and a user with write access to the repo clicks the **Approve and run workflows** button. See [AUTOTITLE](/copilot/using-github-copilot/coding-agent/reviewing-a-pull-request-created-by-copilot). -* **Prevents the user who asked {% data variables.product.prodname_copilot_short %} to create a pull request from approving it.** This maintains the expected controls in the "Required approvals" rule and branch protection. See [AUTOTITLE](/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets). +* **Limits who can assign tasks to {% data variables.copilot.copilot_coding_agent %}.** Only users with write access to the repository can trigger {% data variables.copilot.copilot_coding_agent %} to work. Comments from users without write access are never presented to the agent. +* **Limits the permissions in access tokens used by {% data variables.copilot.copilot_coding_agent %}.** Pushes are only allowed to branches beginning with `copilot/`. {% data variables.copilot.copilot_coding_agent %} cannot push to the `main` or `master` branches. +* **Limits {% data variables.copilot.copilot_coding_agent %}'s credentials.** {% data variables.copilot.copilot_coding_agent %} can only perform simple push operations. It cannot directly run `git push` or other Git commands. +* **Restricts {% data variables.product.prodname_actions %} workflow runs.** Workflows are not triggered until {% data variables.copilot.copilot_coding_agent %}'s code is reviewed and a user with write access to the repo clicks the **Approve and run workflows** button. See [AUTOTITLE](/copilot/using-github-copilot/coding-agent/reviewing-a-pull-request-created-by-copilot). +* **Prevents the user who asked {% data variables.copilot.copilot_coding_agent %} to create a pull request from approving it.** This maintains the expected controls in the "Required approvals" rule and branch protection. See [AUTOTITLE](/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets). -### Risk: {% data variables.product.prodname_copilot_short %} has access to sensitive information +### Risk: {% data variables.copilot.copilot_coding_agent %} has access to sensitive information -{% data variables.product.prodname_copilot_short %} has access to code and other sensitive information, and could leak it, either accidentally or due to malicious user input. To mitigate this risk, {% data variables.product.github %}: +{% data variables.copilot.copilot_coding_agent %} has access to code and other sensitive information, and could leak it, either accidentally or due to malicious user input. To mitigate this risk, {% data variables.product.github %}: -* **Restricts {% data variables.product.prodname_copilot_short %}'s access to the internet.** See [AUTOTITLE](/copilot/customizing-copilot/customizing-or-disabling-the-firewall-for-copilot-coding-agent). +* **Restricts {% data variables.copilot.copilot_coding_agent %}'s access to the internet.** See [AUTOTITLE](/copilot/customizing-copilot/customizing-or-disabling-the-firewall-for-copilot-coding-agent). ### Risk: Prompt injection vulnerabilities -Users can include hidden messages in issues assigned to {% data variables.product.prodname_copilot_short %} or comments left for {% data variables.product.prodname_copilot_short %} as a form of [prompt injection](https://genai.owasp.org/llmrisk/llm01-prompt-injection/). To mitigate this risk, {% data variables.product.github %}: +Users can include hidden messages in issues assigned to {% data variables.copilot.copilot_coding_agent %} or comments left for {% data variables.copilot.copilot_coding_agent %} as a form of [prompt injection](https://genai.owasp.org/llmrisk/llm01-prompt-injection/). To mitigate this risk, {% data variables.product.github %}: -* **Filters hidden characters before passing user input to {% data variables.product.prodname_copilot_short %}**: For example, text entered as an HTML comment in an issue or pull request comment is not passed to {% data variables.product.prodname_copilot_short %}. +* **Filters hidden characters before passing user input to {% data variables.copilot.copilot_coding_agent %}**: For example, text entered as an HTML comment in an issue or pull request comment is not passed to {% data variables.copilot.copilot_coding_agent %}. ## Limitations of {% data variables.copilot.copilot_coding_agent %} {% data variables.copilot.copilot_coding_agent %} has certain limitations in its software development workflow and compatibility with other features. -### Limitations in {% data variables.product.prodname_copilot_short %}'s software development workflow +### Limitations in {% data variables.copilot.copilot_coding_agent %}'s software development workflow * **{% data variables.product.prodname_copilot_short %} can only make changes in the same repository where it is creating its pull request**. When {% data variables.product.prodname_copilot_short %} is assigned an issue, it can only make changes in the repository where that issue is located. In addition, {% data variables.product.prodname_copilot_short %} cannot make changes across multiple repositories in one run. * **{% data variables.product.prodname_copilot_short %} can only access context in the same repository as the assigned issue**. By default, an integration with the {% data variables.product.prodname_copilot_short %} MCP server provides {% data variables.product.prodname_copilot_short %} access to one repository at a time. You can, however, configure broader access. See [AUTOTITLE](/copilot/using-github-copilot/coding-agent/extending-copilot-coding-agent-with-mcp). * **{% data variables.product.prodname_copilot_short %} can only open one pull request at a time**. {% data variables.product.prodname_copilot_short %} will open exactly one pull request to address each task it is assigned. -### Limitations in Copilot's compatibility with other features +### Limitations in {% data variables.copilot.copilot_coding_agent %}'s compatibility with other features * **{% data variables.product.prodname_copilot_short %} does not sign its commits**. If you have the "Require signed commits" rule or branch protection enabled, you must rewrite the commit history in order to merge {% data variables.product.prodname_copilot_short %}'s pull requests. See [AUTOTITLE](/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets#require-signed-commits). * **{% data variables.copilot.copilot_coding_agent %} does not work in personal repositories owned by {% data variables.enterprise.prodname_managed_users %}**. This is because {% data variables.copilot.copilot_coding_agent %} requires {% data variables.product.company_short %}-hosted runners, which are not available to repositories owned by {% data variables.enterprise.prodname_managed_users %}. See [AUTOTITLE](/actions/using-github-hosted-runners/using-github-hosted-runners/about-github-hosted-runners).