Copilot code review can follow instructions from the branch being tested

GitHub expanded Copilot code review on July 17, 2026, with branch-based custom instructions, dedicated setup workflows, firewall controls, and independent runner configuration. The changes give development teams more control over the context and environment used to review pull requests, helping AI feedback reflect a web project's own frontend standards and development tools.

{getToc} $title={Table of Contents}

Copilot code review can follow instructions from the branch being tested

Copilot code review now reads custom instructions from the head branch of a pull request instead of the base branch. A team can therefore update its review guidance inside a feature branch and test how Copilot applies those rules to the same pull request before merging them into the main repository.

The supported context includes copilot-instructions.md, *.instructions.md, agent skills, and AGENTS.md. Copilot can also read existing REVIEW.md, GEMINI.md, and CLAUDE.md files, allowing teams to reuse documented conventions instead of maintaining a separate set of review rules for every AI tool.

{getCard} $type={post} $title={More useful reading}

A dedicated workflow file prepares the review environment

Repositories can now add .github/workflows/copilot-code-review.yml to configure the runtime environment used by Copilot code review. The workflow can install dependencies, prepare project tools, define setup steps, and configure repository-level runners independently from the Copilot cloud agent.

If the dedicated file is not present, code review falls back to an existing copilot-setup-steps.yml workflow. When both exist, the new file is used for review work, allowing a frontend team to prepare different environments for reviewing pull requests and completing broader cloud agent tasks.

Firewall rules separate review access from the cloud agent

Copilot code review now runs behind a firewall by default, restricting its network access while a review is taking place. Repository administrators can configure the allowed access through Settings > Copilot > Internet access.

These firewall settings are independent from the controls used by the Copilot cloud agent. A team can therefore allow the domains needed for package installation, documentation, or internal development tools without automatically giving both agents the same network access.

Organizations can choose different runners for review work

Copilot code review and the Copilot cloud agent previously shared one organization-level runner configuration. GitHub has separated them into individual sections, allowing administrators to choose a different runner type for each agent according to its workload and environment requirements.

The options are available through Organization settings > Copilot > Runner type. This separation can help teams keep pull request reviews lightweight while reserving another runner configuration for cloud agent tasks that require additional dependencies, resources, or preparation.

IMPORTANT: The firewall is enabled by default, but it is not currently supported on self-hosted runners. Copilot code reviews using those runners continue without this firewall, so teams should verify their own network controls before relying on the new protection.{alertWarning}

Daisuki's Take: What This Means for Web Designers

This update makes AI code review more adaptable to the standards behind a real website. Frontend teams can describe component conventions, accessibility expectations, CSS practices, framework rules, and other project-specific checks that generic feedback may overlook.

We would treat these instruction files as part of the repository's review policy rather than as one-time prompts. An unclear or outdated rule can produce repeated low-value comments, so changes to the guidance should be reviewed as carefully as other shared development configuration.

The dedicated environment and network controls also make Copilot easier to fit into established production workflows. AI review can provide an additional layer of feedback, but responsive layouts, visual consistency, browser behavior, accessibility, and final code approval still need direct human verification.

{getCard} $type={custom} $title={What's New?} $info={Find more AI Web design news} $icon={}

Sources and Recommended Links

• Copilot code review: Customization and configurability improvements | GitHub Official Changelog
• Using GitHub Copilot code review | GitHub Copilot Official Documentation