Configuring settings for GitHub Copilot in the cloud

Configuring plugins for Copilot in the cloud

To configure plugins for Copilot in the cloud, add the marketplace and plugin to .github/copilot/settings.json in the repository. For example:

{
  "extraKnownMarketplaces": {
    "MARKETPLACE-NAME": {
      "source": {
        "source": "github",
        "repo": "OWNER/REPOSITORY"
      }
    }
  },
  "enabledPlugins": {
    "PLUGIN-NAME@MARKETPLACE-NAME": true
  }
}

{
  "extraKnownMarketplaces": {
    "MARKETPLACE-NAME": {
      "source": {
        "source": "github",
        "repo": "OWNER/REPOSITORY"
      }
    }
  },
  "enabledPlugins": {
    "PLUGIN-NAME@MARKETPLACE-NAME": true
  }
}

Replace OWNER/REPOSITORY with the marketplace repository, MARKETPLACE-NAME with the name in its marketplace.json file, and PLUGIN-NAME with the plugin name. Commit the settings file to share this configuration. There is no local override for these settings. For the supported settings, see GitHub Copilot CLI configuration directory.

Enabling or disabling built-in code quality and security validation tools

By default, Copilot cloud agent checks code it generates for security issues and gets a second opinion on its code with Copilot code review. It attempts to resolve issues identified prior to completing the pull request. This improves code quality and reduces the likelihood of the code generated by Copilot cloud agent introducing problems such as hardcoded secrets, insecure dependencies, and other vulnerabilities.

Optionally, you can choose to disable these tools to help Copilot work faster or avoid conflicts with other code quality or security products you're using.

You must be a repository administrator to configure these settings.

1. On GitHub, navigate to the main page of the repository.

2. Under your repository name, click Settings. If you cannot see the "Settings" tab, select the dropdown menu, then click Settings.

   

3. In the sidebar, under "Code, planning, and automation", click Copilot then Cloud agent.

4. On the "Copilot in the cloud" page, in the "Validation tools" section, toggle the tool, or tools, you want to enable or disable.

Allowing GitHub Actions workflows to run automatically when Copilot pushes

By default, GitHub Actions workflows will not run automatically when Copilot pushes changes to a pull request.

GitHub Actions workflows can be privileged and have access to sensitive secrets. Inspect the proposed changes in the pull request and ensure that you are comfortable running your workflows on the pull request branch. You should be especially alert to any proposed changes in the .github/workflows/ directory that affect workflow files.

To allow GitHub Actions workflows to run, click the Approve and run workflows button in the pull request's merge box.

Optionally, you can configure Copilot cloud agent to allow GitHub Actions workflows to run without human intervention.

You must be a repository administrator to configure these settings.

1. On GitHub, navigate to the main page of the repository.

2. Under your repository name, click Settings. If you cannot see the "Settings" tab, select the dropdown menu, then click Settings.

   

3. In the sidebar, under "Code, planning, and automation", click Copilot then cloud agent.

4. On the "Copilot in the cloud" page, in the "Policies" section, disable the Require approval for workflow runs setting.