GitHub puts Copilot code review behind a default firewall

GitHub has turned Copilot code review into a more separately managed agent surface. The July 17 changelog says Copilot code review now runs behind a firewall by default, can use its own setup workflow, and no longer has to share one organization-level runner configuration with Copilot cloud agent.

For teams already letting AI review pull requests, this is a control-plane update rather than a new button. It changes where review instructions come from, which network access the reviewer has, and how administrators can prepare the runtime without opening the same path used by a coding agent.

Copilot code review gets its own runtime path

The largest operational change is a dedicated workflow file: .github/workflows/copilot-code-review.yml. GitHub says teams can use it to install dependencies, prepare tooling, configure repository-level runners, or run other setup steps before Copilot code review evaluates a pull request.

If the dedicated file is not present, Copilot code review falls back to an existing .github/workflows/copilot-setup-steps.yml file. That fallback keeps older setups working, but it also makes the migration decision explicit: teams that want review-only preparation should split the workflow instead of letting review and coding-agent jobs share one environment recipe.

The docs frame the review environment as ephemeral, similar to the Copilot cloud agent environment. That matters for security review, generated-code checks, and repos that need build artifacts or generated types before an automated reviewer can make useful comments.

GitHub separates review firewall settings from the coding agent

Copilot code review now runs with firewall restrictions by default. GitHub says administrators can configure the domains and URLs available to Copilot code review at the organization or repository level, in a separate section from Copilot cloud agent inside the same Internet access settings area.

That separation is the practical point. A reviewer may need package registries, internal documentation, or a narrow artifact host, while a coding agent may need a different allowlist to complete longer tasks. Treating them as the same network actor makes governance harder; GitHub is now giving administrators a way to make the review path narrower.

There is an important caveat: GitHub says self-hosted runners do not currently support the Copilot code review firewall. Repositories using self-hosted runners for review should not assume the same default network boundary applies. They need runner-level egress controls or a separate policy until GitHub closes that gap.

Instruction files now behave more like pull request code

GitHub also changed how Copilot code review reads custom instructions. The reviewer now reads instructions from the pull request's head branch, so teams can test review-policy changes in the same branch that proposes them.

That is useful, but it needs governance. If a pull request can change AGENTS.md, copilot-instructions.md, REVIEW.md, GEMINI.md, or CLAUDE.md, the reviewer may evaluate the code with the branch's proposed policy rather than only the already-merged policy. For ordinary style guidance, that makes iteration easier. For security or compliance rules, reviewers should compare instruction-file diffs and decide which rules are advisory and which are enforced elsewhere.

The expanded file support is still a strong convenience win. Teams that already maintain CLAUDE.md, GEMINI.md, REVIEW.md, or AGENTS.md no longer need to duplicate every review convention into a Copilot-only file.

What admins should check this week

Teams using Copilot code review should audit four things before they treat the new defaults as protection:

The immediate implication is narrow but important: Copilot code review is no longer just another Copilot feature attached to pull requests. It is becoming a governed agent lane with its own environment, network boundary, and instruction surface.

Evidence

GitHub's changelog is the primary source for the July 17 rollout, including the dedicated setup file, default firewall, runner split, and self-hosted-runner caveat. daily.dev and QATechTools also surfaced the same update, which supports treating this as a visible platform change rather than an isolated docs edit.