GitHub’s June 2026 Copilot code-review update gives organizations more control over where reviews run, which repository content Copilot can inspect, and how much custom guidance a repository can provide. The changes matter most to platform and security teams trying to standardize AI-assisted review across many repositories.
Three controls changed
First, administrators can set a default runner type for Copilot code review at the organization level and lock that choice across repositories. Teams may use the standard GitHub-hosted runner, a larger runner, or a self-hosted runner where supported.
Second, code review now respects Copilot content-exclusion rules configured at repository, organization, or enterprise level. Administrators can exclude files or directories that should not be used as review context.
Third, GitHub removed the previous 4,000-character reading limit for copilot-instructions.md and *.instructions.md files in the .github directory. Longer guidance can now influence review, although clear and testable instructions are still better than an undifferentiated policy dump.
What organization-level runner policy solves
A central default reduces repository-by-repository drift. It can help an enterprise keep review workloads on an approved runner class and apply the same choice to both Copilot code review and Copilot cloud agent where enabled. Self-hosted runners also create operational duties around patching, network access, capacity, and secret isolation.
What content exclusion does—and does not—do
Exclusion rules can keep selected paths out of Copilot’s review context. That is useful for material that is irrelevant, unusually sensitive, generated, or likely to distract the review. It should not be treated as a complete data-loss-prevention or access-control system. Teams still need repository permissions, secret scanning, branch protections, and a clear review policy.
A careful rollout plan
- Choose a small set of repositories with active maintainers and representative pull requests.
- Set the runner policy and document who may change it.
- Define narrow content exclusions and verify them with controlled test changes.
- Write repository instructions around concrete risks, conventions, and evidence—not general style preferences.
- Measure useful findings, false positives, reviewer time, and missed defects before expanding.
Test excluded paths and instruction changes with deliberately constructed pull requests. A policy is only useful if administrators can demonstrate that the review system follows it consistently.
Pricing and access
These controls operate within GitHub Copilot code review and GitHub Actions. Availability and usage costs can vary by organization plan, Copilot entitlement, and runner choice. Check GitHub’s current plan and Actions documentation before estimating total cost.
Kingy AI verdict
This update improves governability rather than changing the underlying quality of every review. Central runner settings, exclusion support, and longer instructions give administrators better levers. The real test is whether those levers reduce review noise without hiding important context or creating unmanaged runner risk.
Primary sources
Related Kingy AI links
Kingy Launch Brief
Put the week’s verified AI launches in your inbox.
One source-checked edition every Friday, with a clear try, watch or skip verdict. After subscribing, check your inbox and confirm your address.
Free · Fridays · Double opt-in · Unsubscribe anytime