Problem
Copilot only reviews a PR if a maintainer remembers to request it, and we usually forget. Turning it on for every PR is worse though — drive-by PRs from forks would burn review budget for nothing.
Proposal
A workflow at .github/workflows/copilot-review.yml that asks Copilot for a review when (and only when) the PR author is a maintainer.
Trigger: pull_request_target on opened, reopened, and ready_for_review. pull_request_target rather than pull_request so the job can write to the PR even when it came from a fork.
Gate: check github.event.pull_request.author_association against OWNER, MEMBER, COLLABORATOR. Skip drafts.
Action: gh api POST /repos/{owner}/{repo}/pulls/{pr}/requested_reviewers with reviewers: ["Copilot"].
Permissions: pull-requests: write, nothing else.
Drawbacks
If Copilot review isn't enabled at the org level the API call 4xx's and the run goes red. Noisy but harmless.
Alternatives
- Manual request per PR (status quo, gets forgotten).
- Fire on every PR (defeats the point).
Open question
Re-request on synchronize too, or just once at open? Probably once is enough.
Problem
Copilot only reviews a PR if a maintainer remembers to request it, and we usually forget. Turning it on for every PR is worse though — drive-by PRs from forks would burn review budget for nothing.
Proposal
A workflow at
.github/workflows/copilot-review.ymlthat asks Copilot for a review when (and only when) the PR author is a maintainer.Trigger:
pull_request_targetonopened,reopened, andready_for_review.pull_request_targetrather thanpull_requestso the job can write to the PR even when it came from a fork.Gate: check
github.event.pull_request.author_associationagainstOWNER,MEMBER,COLLABORATOR. Skip drafts.Action:
gh api POST /repos/{owner}/{repo}/pulls/{pr}/requested_reviewerswithreviewers: ["Copilot"].Permissions:
pull-requests: write, nothing else.Drawbacks
If Copilot review isn't enabled at the org level the API call 4xx's and the run goes red. Noisy but harmless.
Alternatives
Open question
Re-request on
synchronizetoo, or just once at open? Probably once is enough.