When GitHub Code Quality went GA on 2026-07-20, turning it on also created a repository ruleset that auto-requested Copilot code review on your default branch. On 2026-08-07, GitHub cut that coupling.
Core takeaway: Enabling Code Quality is no longer a back door to automatic Copilot review. Review automation is an explicit ruleset opt-in — and the same-day Lite/Balanced GA means you should set depth on purpose, not by leftover defaults.
Why it matters
Teams drowning in agent-opened pull requests treat “a reviewer appeared” as emotional safety. That signal is dangerous when it was a product side effect.
- Cost: Copilot code review bills to your Copilot plan. If every PR, every push, and even drafts got reviewed because you flipped Code Quality on, you were paying for a policy you never wrote down.
- Noise: A docs typo and an auth migration should not share the same automatic depth. People start rubber-stamping “the agent reviewed it.”
- Category error: GitHub frames Code Quality and Copilot code review as integrated-but-separate. Persistent findings, gates, and reporting are not the same thing as ephemeral review comments while you author. One product on ≠ the other covering you.
The same day also shipped Lite/Balanced effort levels to GA. So the questions stack: should review run automatically, and how deep should it dig?
How it compares
| Layer | Job | What changed on Aug 7 |
|---|---|---|
| Code Quality | CodeQL + AI findings, Autofix, ruleset quality gates, dashboards | Stays. Only the auto-created Copilot reviewer ruleset path was cut. |
| Copilot code review | PR comments; optional automatic requests | Feature unchanged. Automatic request is opt-in again. |
| Human required reviewers | Merge accountability | Still the real gate. Do not replace humans with agent review theater. |
After Code Quality GA, enablement created a ruleset named Code Quality Copilot review for default branch. After the Aug 7 reversal:
- New enablements no longer create that ruleset.
- Existing GitHub-created rulesets that still match the original get three settings turned off:
- Automatically request Copilot code review
- Review new pushes
- Review draft pull requests
- Rulesets you edited stay as you set them. Rulesets you authored yourself are never touched.
- The leftover ruleset object can remain with those settings off — delete it if you do not want the clutter.
Scope: Code Quality on GitHub Team and GitHub Enterprise Cloud.
Code / config example
Pin the audit → decide → re-enable loop.
# 1) Audit (org + high-traffic repos)
[ ] Settings → Rules → Rulesets
[ ] Find: "Code Quality Copilot review for default branch"
[ ] Note auto-request / review-new-pushes / review-drafts
[ ] List any org-level Copilot review rulesets you wrote
# 2) Write the policy (do not resurrect GA-era defaults blindly)
[ ] Auto Copilot review? off | ready PRs only | every push | include drafts
[ ] Default effort: Lite (routine) vs Balanced (auth / payments / multi-service)
[ ] Repo overrides: docs/marketing vs platform/security
# 3) Re-enable only where intentional
[ ] Create/edit branch ruleset → Enforcement: Active
[ ] Target branches
[ ] Enable: Automatically request Copilot code review
[ ] Optional: Review new pushes / Review draft pull requests
[ ] Org Settings → Copilot → Copilot code review → default effort
Effort level is labeled on timeline events and the PR overview comment — use that as an audit signal. Balanced routes to a higher-reasoning path and burns more AI credits and Actions minutes than Lite. The changelog does not publish a fixed multiplier, so neither will this draft.
Personal Pro/Pro+ “auto-review PRs I create” is a different axis from repo/org rulesets. Do not conflate them.
Practical use
Policy by repository class beats “turn everything back on.”
- Docs / content / localization: auto Copilot review off or Lite; drafts off. Code Quality gates may be enough.
- Default app services: auto-request on ready PRs only + Lite default; keep human required reviewers.
- Auth, payments, multi-service boundaries: Balanced as repo default or per-review override. Be careful with review-on-every-push where agents spam commits — cost spikes fast.
- Agent-opened PRs: do not default to “Balanced + every push.” Prefer label/path rules, or auto-review only after a human marks the PR ready.
I burned half a morning once thinking Copilot “stopped working” on a Code Quality repo. Opening Rulesets showed the three toggles flipped off — not a model regression, just this changelog catching up with us. Since then, quality-product enablement and reviewer policy live on separate checklist lines.
Senior-engineer perspective
When a default assigns a reviewer, the team has consented without deciding. GitHub was right to unwind the coupling after feedback. The operational cost is a silent disable: orgs that skip changelogs only notice “reviews got quieter” and blame the model.
Two senior moves:
- Observe: inventory leftover CQ Copilot rulesets and org rulesets this sprint.
- Document: one paragraph in the platform runbook — which repos auto-request Copilot, Lite vs Balanced, draft/push behavior.
In the agent era, a reviewer seat is budgeted compute, not a free seatbelt.
Using it in Cursor
Cursor cloud agents and Copilot agents that open PRs can no longer assume “review will show up.” Put this in the agent brief:
Before claiming "Copilot will review this PR automatically":
1. Check repo Rulesets for automatic Copilot code review.
2. If missing, request review manually or ask a human to confirm org policy.
3. For auth/payment/multi-service diffs, request Balanced effort when available.
4. Do not treat Code Quality findings as a substitute for Copilot or human review.
One extra line — ruleset audit — on your local↔cloud handoff checklist stops the wrong debugging story (“the model failed”) when the real story is policy.
FAQ
Q. Do we need to disable Code Quality?
A. No. Findings/gates stay. Only the auto-created Copilot reviewer attachment was reversed. Keep CQ; rewrite review policy.
Q. Are the old rulesets deleted?
A. For untouched GitHub-created rulesets, the three settings are turned off and the object can remain. Edited rulesets stay as you left them. Delete leftovers if you want a clean slate.
Q. What are Lite and Balanced?
A. GA on 2026-08-07. Lite is the standard/fast default; Balanced is deeper analysis for complex, security-sensitive, or cross-service changes (more credits and Actions minutes). Preview Low/Medium rename and carry forward.
Q. How do we turn automatic review back on?
A. Add or edit a repository or organization branch ruleset and enable Automatically request Copilot code review. See GitHub’s configure-automatic-review docs.
Sources
- GitHub Code Quality no longer adds Copilot as a reviewer (2026-08-07)
- Copilot code review effort levels are generally available (2026-08-07)
- GitHub Code Quality is now generally available (2026-07-20)
- Configuring automatic code review by GitHub Copilot
- About GitHub Copilot code review
- GitHub Code Quality
Closing
For the next few quarters, “quality product on” and “reviewer automation on” will keep drifting apart. Do not trust defaults. Write one page for who reviews, when, and how deep — sized to repo risk and agent PR volume. That page saves more money than another model swap.