# GitHub Copilot code review can now approve pull requests GitHub has added an opt-in approval path to Copilot code review, with separate controls for letting Copilot submit an Approve review and letting that approval satisfy merge requirements; repositories can narrow merge-counting to selected file-path globs. Copilot code review now moves from advisory assessment toward a governed merge gate. The public preview remains off by default, and GitHub’s current docs let administrators separate AI approval itself from whether that approval counts toward required-review policy. - Status: Active - Published: 2026-09-03T18:24:24+12:00 - Updated: 2026-09-04T21:03:34+12:00 - Categories: Artificial Intelligence, Web Development, AI Coding, Developer Tools - Tags: AI governance, code review, GitHub, GitHub Copilot, merge policy, pull requests - Canonical HTML: https://beyondthe.news/dossiers/github-copilot-code-review-approvals ## Latest material change Repairs the dead GitHub Docs source and tightens the governance details using GitHub's current documentation: allowing Copilot to submit Approve reviews and allowing those approvals to satisfy merge requirements are separate repository controls, with up to 15 path globs available for merge-counting scope. ## What changed GitHub announced September 1, 2026 that Copilot code review can submit approving pull-request reviews when administrators enable the capability. Every Copilot review includes an approval assessment, but the assessment alone does not count toward merge requirements. GitHub’s current repository documentation makes the governance split explicit: `Allow Copilot to approve pull requests` lets Copilot submit Approve reviews, while `Allow Copilot approvals to count toward merge requirements` separately controls whether those reviews can satisfy approval requirements. Repository admins can also enter up to 15 file globs; an approval counts toward merge requirements only when every changed file matches the allowed globs. Enterprise and organization policies can disable the feature, enable it broadly, select repositories or delegate the final decision downward. ## Why it matters This changes Copilot code review from an advisory comment stream into a potential merge-control participant, but it does not have to be all-or-nothing. A team can permit Copilot to express an approval without granting that approval merge authority, then separately decide where AI approvals can satisfy required-review rules. That separation is useful for staged adoption: repositories can collect evidence on AI review quality before allowing it to replace a human approval in bounded paths. ## An approval assessment is not the same as an approving review Every Copilot code review includes an assessment of whether the pull request looks ready to approve. By itself, that assessment is advisory and does not satisfy merge requirements. Copilot submits an actual Approve review only when the relevant approval setting is enabled. ## Approval and merge authority are separate controls GitHub’s current repository settings expose one control to let Copilot approve pull requests and another to let those approvals count toward merge requirements. That means teams can trial visible AI approvals without immediately treating the bot as a required-review substitute. ## Path scope can bound which approvals count Repository admins can provide up to 15 file globs for merge-counting. GitHub says Copilot’s approval counts toward merge requirements only when every changed file in the pull request matches one of those globs. That can keep infrastructure, security or other sensitive paths outside the AI approval boundary. ## The policy surface is hierarchical Enterprise administrators can keep approvals disabled or allow organizations to decide. Organizations can enable them everywhere, choose selected repositories, delegate to repository admins or disable them. Repository settings provide the final approval and path controls where higher-level policy permits them. ## New commits invalidate the old approval If commits are pushed after Copilot approves, GitHub dismisses the approval like a human review and a fresh review can be requested. Teams should still define whether a human must re-review high-risk changes even when Copilot returns another approval. ## Key details - Announced September 1, 2026. - Copilot approvals are in public preview. - Every Copilot code review includes an approval assessment, which does not itself count toward merge requirements. - Submitting an Approve review is off by default. - Repositories can separately control whether Copilot may approve and whether its approvals count toward merge requirements. - Repository admins can specify up to 15 file globs for approvals that count toward merge requirements. - GitHub says every changed file must match the configured globs for the Copilot approval to count. - Enterprise, organization and repository policies control enablement. - A new commit dismisses Copilot's prior approval. ## Builder takeaways - Start by enabling Copilot approval reviews without allowing them to count toward merge requirements; measure false approvals before granting merge authority. - Use path globs to exclude security, infrastructure, deployment and other high-risk files from AI approvals that count. - Review organization and enterprise policy inheritance so repository settings cannot accidentally widen a centrally intended restriction. - Define an explicit re-review process after pushes, because new commits invalidate the previous Copilot approval. - Keep human CODEOWNERS or required-review controls for paths where accountability or domain expertise matters more than review throughput. - Audit the GitHub setting periodically while the feature is in public preview because controls and semantics may change. ## What to watch - Whether GitHub publishes approval-quality measurements, audit events or templates for regulated teams. - How Copilot approvals interact in practice with CODEOWNERS, enterprise rulesets and merge queues. - Whether GitHub expands path controls beyond the current up-to-15-glob mechanism. - Whether the separate approve-versus-count controls change as the feature moves toward general availability. ## Uncertainties - The feature is public preview and GitHub provides no independent approval-quality measurement. - The value of path gating depends on repository structure; broad globs can still grant Copilot meaningful merge authority. - GitHub’s documentation has recently moved URLs, so source links and detailed settings should be rechecked during preview. ## Sources - [Copilot code review can now approve pull requests](https://github.blog/changelog/2026-09-01-copilot-code-review-can-now-approve-pull-requests/) — GitHub Changelog · primary changelog · 2026-09-01T00:00:00+12:00. Primary announcement for approval assessments, public-preview status, hierarchy and dismissal after new commits. - [Configuring code review by GitHub Copilot](https://docs.github.com/en/copilot/how-tos/copilot-on-github/set-up-copilot/configure-code-review) — GitHub Docs · primary documentation. Current configuration documentation for the separate approve/count controls, organization and enterprise policy, and up-to-15 file-glob restriction. - [Using GitHub Copilot code review on GitHub](https://docs.github.com/en/copilot/how-tos/copilot-on-github/use-copilot-agents/copilot-code-review) — GitHub Docs · primary documentation. Current usage documentation explaining default Comment reviews, opt-in Approve reviews and re-review behavior. - [About protected branches and required pull request reviews](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches) — GitHub Docs · primary documentation. Context for required-review branch controls.