💡 Copilot Code Review Custom Instructions Fleet Deployment Standard

[github-actions[bot]]

Summary

Establish an org standard for deploying consistent Copilot code review instructions across all repos via REVIEW.md files, leveraging the new Copilot features (org-level instructions, agent skills, MCP server integration) that reached GA in July 2026. Integrate with the existing standards-deploy infrastructure to keep instructions synchronized fleet-wide.

Market Signal

GitHub Copilot code review underwent a major capability expansion in mid-2026:

• Custom instructions now read from REVIEW.md, CLAUDE.md, and GEMINI.md files (June 2026)
• Character limits on repo instructions were removed
• Instructions can be tested from feature branches before merging
• Agent skills and MCP servers reached GA (July 2026) — teams can bring internal tools and standards into every code review
• Org-level custom instructions are available for Business/Enterprise

This shifts Copilot from a generic reviewer to a team-customizable review engine — but only if instructions are deployed consistently across the fleet.

Sources: Copilot code review customization improvements, Shape Copilot code review around your team, Copilot code review agent skills and MCP GA

User Signal

• The org already maintains CLAUDE.md and AGENTS.md across repos via standards-deploy
• AGENTS.md encodes detailed standards (SOLID, CLEAN, DRY, security boundaries, structured logging, CQRS) that human reviewers enforce
• Copilot reviews currently use generic heuristics — the org-specific conventions are invisible to the AI reviewer
• The natural extension is deploying REVIEW.md files so Copilot reviews enforce the same standards human reviewers do

Technical Opportunity

The standards-deploy workflow already syncs workflow stubs to consumer repos. The deployment infrastructure exists:

• Add a REVIEW.md template to standards/workflows/ alongside existing stubs
• Include it in DEPLOYABLE_WORKFLOWS — zero new infrastructure needed
• Agent skills (.github/skills/) can encode org-specific patterns as reusable review checks
• MCP server connections (read-only, GA) can pull context from issue trackers and documentation

The new job.workflow_ref context properties (September 2026) enable review skills to identify which workflow is being reviewed for context-specific feedback.

Assessment

Dimension	Score	Rationale
Feasibility	high	Extends existing standards-deploy pipeline; REVIEW.md is just a file to deploy
Impact	high	Every PR reviewed by Copilot gets org-specific standards — multiplier on review quality
Urgency	med	The Copilot features are GA and stable; adoption is valuable but not blocking

Adversarial Review

Strongest objection: Over-prescriptive review instructions cause noisy reviews — Copilot may flag patterns that are not actual violations, causing developers to ignore all AI review comments. The instruction quality problem is harder than the deployment problem.

Rebuttal: The standard explicitly addresses this: start with a small set of high-confidence rules (the org's strongest conventions from AGENTS.md), measure signal-to-noise ratio via Copilot's resolution feedback loop (how often are AI comments resolved vs dismissed?), and iterate. Deployment without quality control is noise; quality control without deployment is inconsistency. The standard covers both dimensions.

Suggested Next Step

Draft a REVIEW.md template encoding the org's top 5-10 review rules from AGENTS.md (SOLID, CLEAN, security boundaries, structured logging), add it to standards/workflows/, and wire it into standards-deploy with a feature flag for opt-in rollout.