What's new with GitHub Copilot code review (CodeQL, agents & more)

Key Concepts

• GitHub Copilot code review agent: An AI-powered tool that assists in code review.
• Agentic workflow: A system where an AI agent orchestrates multiple tools and processes to achieve a goal.
• Deterministic detections: Code analysis that produces consistent and predictable results, unlike purely probabilistic AI models.
• CodeQL: A powerful code analysis engine used for security and correctness checks.
• Linters: Tools that automatically check code for stylistic errors, bugs, and suspicious constructs.
• GitHub Actions: A CI/CD platform that allows automation of software development workflows.
• Repository-wide context: The ability of the AI to understand and analyze the entire codebase, not just individual files.
• Stacked pull request: A pull request that builds upon another, allowing for sequential review and merging of changes.
• Custom instructions: User-defined guidelines that can be provided to Copilot to influence its review process.

Enhanced GitHub Copilot Code Review Agent

This video details the significant upgrades to the GitHub Copilot code review agent, focusing on a more intelligent agentic workflow. This new workflow integrates AI-driven feedback with deterministic detections from a dedicated code analysis engine.

Repository-Wide Context and Tool Orchestration

The enhanced Copilot agent can now reason over an entire repository, providing a richer context that spans across multiple files and services. This holistic understanding allows for more comprehensive analysis. The agent orchestrates various tools, including deterministic detections like CodeQL and linters.

• CodeQL Integration: The agent leverages CodeQL, the same industry-leading analysis engine that powers GitHub's security features. This ensures precise, security-aware, and correctness-focused feedback.
• Linter Validation: Linters are employed to provide instant validation for common coding issues, ensuring immediate feedback on basic errors.

Workflow Visibility and Execution

The entire Copilot code review process now runs on GitHub Actions. This provides transparency and allows users to monitor the full workflow in the repository's Actions tab. Users can observe the agent orchestrating tools, traversing the repository, and posting its results back to the pull request.

Actionable Feedback and Automated Fixes

Copilot's comments are delivered inline within the pull request, offering focused and actionable guidance.

• Commit Suggestion Button: For many suggestions, a "commit suggestion" button is available, enabling users to apply fixes in a single click.
• Handoff to Coding Agent: Users can now hand off to the GitHub Copilot coding agent. This agent creates a stacked pull request with proposed fixes already applied on top of the current branch. This allows for separate review and merging of these automated changes.
• Multiple Suggestions and Conflict Resolution: If multiple suggestions are made, the agent can apply them together and automatically resolve any potential conflicts between them.

Customization and Iterative Review

The system allows for user-defined steering of the review process through custom instructions.

• Custom Instructions: Users can add custom instructions to their repository. Copilot will then incorporate these conventions, patterns, and guidelines into its comments and suggestions, tailoring the review to specific project needs.
• Fresh Pass Reviews: After addressing feedback, users can request a new Copilot review. Each subsequent review is designed to focus on new insights, ensuring a high signal-to-noise ratio and avoiding redundant feedback.

Conclusion

The upgraded GitHub Copilot code review agent represents a significant advancement in AI-assisted code review. By combining broad repository-wide context with precise deterministic analysis from tools like CodeQL and linters, and by offering features like one-click fixes and stacked pull requests for automated changes, Copilot aims to streamline the code review process, improve code quality, and enhance security. The ability to customize the review process with custom instructions further empowers development teams to align AI feedback with their specific project standards.