How to use Copilot to bind approvals to commits
Copilot bound approval reuse to current commits and enabled stale-review dismissal; the unmerged draft also corrected clean-sweep reporting and pinned CI.
github.com
Original prompt
Shared by the source author. See source notes for context.
Please review this repository and open one pull request with findings and fixes.
Reach people exploring AI agents
See placements →What happened
The draft ties reused approvals to current commits and dismisses stale reviews, while correcting false sweep findings; it was not merged at verification.
Reported by Aswinmcw with Copilot — GitHubHow the agent did it
- Copilot inspected approval reuse and required the approved review to match the current pull-request head SHA.
- It aligned the managed code-owner ruleset by enabling stale-review dismissal after pushes.
- It corrected empty-array reporting and pinned workflow references, then left riskier error-handling changes for review.
Where a person stepped in
The owner instructed Copilot to keep risky behavior changes report-only. Human review remained pending, and the source acknowledged absent tests for organization-wide mutations.
Copilot’s review of gh-org-guard found that its automated approval logic could treat an older approval as current. The skip check matched the reviewer and approved state without requiring the review to refer to the pull request’s present commit.
The draft binds approval reuse to the current head SHA. It also changes the organization ruleset to dismiss stale code-owner approvals on new pushes and includes that setting among the fields the reconciler manages. The workflow and repository policy therefore reinforce the same boundary: approval for a previous revision is not approval for the changed code.
A separate reporting bug came from expanding empty Bash arrays with a fallback that produced an empty item. Copilot corrected the expansion so a clean security sweep did not generate false findings. It also pinned reusable workflow references.
The source leaves broad exception handling and missing retry behavior as findings because changing their semantics would be riskier. No test framework existed for organization-wide mutation logic. The agent requested owner review, and the proposal remained an unmerged draft. This is a concrete pending control repair with its qualification limits exposed.
Prompt
Original prompt
Source: GitHub · Aswinmcw with Copilot
Frequently asked questions
Why was approved state insufficient?
An approval could refer to a previous commit rather than the current head.
What complements the SHA check?
The managed ruleset dismisses stale reviews when new commits are pushed.
What validation gap remained?
There was no test framework for organization-wide mutation logic.
More details
About this account
Copilot inspected approval reuse and required the approved review to match the current pull-request head SHA. It aligned the managed code-owner ruleset by enabling stale-review dismissal after pushes.
Original PR, API dates and workflow/reconciler diffs opened. This account describes pending approval-control changes rather than a completed organization rollout. Report-only exception and retry findings remain unresolved. Original prompt excerpt.
Credit: Aswinmcw with Copilot — GitHub
Source published 12 Oct 2026
Source checked 14 Oct 2026
Tools and topics
GitHub Copilot · GitHub Actions · Python · jq · Bash
approval integrity · CI security · commit identity
Editorial completeness: 100/100. Measures documented fields, not agent performance or verified outcomes.