How to automate code reviews and testing with GitHub Copilot

Key Concepts:

• Pull Request (PR) review
• GitHub Copilot (Code Review, AutoFix)
• Code Scanning (GitHub security tool)
• Insecure code (e.g., exec function)
• Type hints (Python)
• Rule sets (Repository settings)
• Copilot instructions file
• Codespaces
• Workflow status checks

Pull Request Review with Copilot and Code Scanning

The video demonstrates how GitHub Copilot and Code Scanning can be used to improve the quality and security of code in a pull request (PR) before it's reviewed by the team. The presenter starts with a deliberately flawed PR to showcase the tools' capabilities.

• Copilot Code Review: Copilot automatically expands on the PR description, listing changed files and providing an initial review. It identifies insecure code (use of the exec command) and suggests a fix. It also flags issues with type hints (missing and incorrect ones).
  • Example: Copilot identifies the use of the exec command as insecure and offers a suggested replacement.
  • Example: Copilot identifies missing and incorrect type hints in Python code.
• Code Scanning: GitHub's security tool detects vulnerabilities in the code. In this case, it also identifies the exec function call.
  • Copilot AutoFix: Part of Code Scanning, Copilot AutoFix generates an explanation of the vulnerability and proposes a solution.
  • Process: The suggested fix is committed, triggering another Code Scanning run to verify the vulnerability is resolved.
• File View: The "Files" tab in the PR displays Copilot Code Review recommendations alongside the code changes. The presenter applies a type hint suggestion directly from the file view, without needing to switch to an IDE.

Repository Settings and Rule Sets

The video highlights the importance of configuring repository settings to enforce code quality and security standards.

• Rule Sets: These define requirements for PRs, such as:
  • Requiring a pull request.
  • Setting a minimum number of human reviewers (e.g., one).
  • Automatically requesting reviews from Copilot.
  • Requiring status checks (frontend and backend tests). These tests are defined in a workflow within the repository.
  • Requiring code scanning results to be clear (no vulnerabilities).
• Copilot Instructions File: This file provides additional context to Copilot, helping it offer more relevant and accurate suggestions. It should be included in any repository where developers use Copilot.
  • Purpose: To give Copilot a better understanding of the project's coding practices and standards.

Reviewing Copilot's Code

The video emphasizes that code generated by Copilot should be reviewed just like code written by any other developer.

• Process: The presenter reviews a PR created by Copilot, which includes a description of the changes and a list of modified files.
• Codespaces: The presenter uses Codespaces to open the code in a development environment and test the changes.
• Feedback Loop: The presenter identifies a visual issue (half-filled star display) and tags Copilot in a comment, requesting an update to add a gradient fill. Copilot implements the change.
• Testing and Approval: The presenter pulls the updated code into the Codespace, reruns the site to verify the fix, and then approves the actions for Copilot's PR to ensure all tests pass.
• Security: Actions for Copilot's PRs require approval for security purposes.

Conclusion

The video demonstrates how GitHub Copilot and Code Scanning can be used to automate and improve the code review process, enhance code quality, and identify and fix security vulnerabilities. It highlights the importance of configuring repository settings and reviewing Copilot's code to ensure that it meets the project's standards. The combination of automated tools and human review provides a comprehensive approach to code quality and security.