Stop treating Copilot like autocomplete. Write a tight issue, assign it to the cloud agent, and review a pull request instead of typing the boilerplate yourself.
See the workflow in action, tap through the tabs below:
// .github/copilot-instructions.md
## Build and test - Install: npm ci - Test: npm test - Lint: npm run lint ## Rules - Never edit files under migrations/ or infra/ - Every change needs a test - Keep PRs under 200 changed lines
// GitHub issue, assigned to Copilot
Title: Add rate limiting to /login Goal: max 5 attempts per minute per IP. Files: src/auth/login.py, tests/test_login.py Done when: tests pass, no new dependencies. Do not touch: migrations/, infra/
// PR comment
@copilot the limiter ignores the X-Forwarded-For header. Read it safely, add a test for a spoofed header, and explain the tradeoff in the PR description.
Gotchas: sessions hard stop at 59 minutes, one branch per task, no cross-repo changes. Treat every PR as untrusted code from a fast junior. Read the diff, run CI, and never auto-merge.
What GitHub Copilot actually is now
Copilot started as autocomplete. In 2026 it is a family of tools: inline completions, chat, agent mode in your editor, and a cloud agent that works on GitHub itself. According to the official docs, the cloud agent explores your repo, makes changes, runs tests and linters inside an ephemeral GitHub Actions environment, pushes a branch, and can open a pull request. You can hand it work from an issue, the agents panel, Copilot Chat, or an @copilot comment on a PR.
This post is about the cloud agent, because that is where the leverage is for DevOps and security people. Autocomplete saves seconds. Delegation saves hours.
Quick setup
The cloud agent is available on all paid Copilot plans, and org admins must enable the policy first. Plans today include Free, Student, Pro, Pro+, Max, Business, and Enterprise, and usage is metered in AI credits per the plans page. Completions stay unlimited on paid plans.
Then do the one thing most people skip: add a repository instructions file. Copilot reads .github/copilot-instructions.md for repo-wide rules, .github/instructions/NAME.instructions.md with an applyTo glob for path-specific rules, and AGENTS.md for agent guidance. The custom instructions guide says to keep it under two pages and include your build, test, and validation commands.
## Build and test - Install: npm ci - Test: npm test ## Rules - Never edit migrations/ or infra/ - Every change needs a test
Path-specific rules
--- applyTo: "**/*.tf" --- Run terraform fmt and terraform validate. Never change provider versions.
The mindset: you are the reviewer, not the typist
Think of the agent as a fast junior engineer who never gets tired and never asks questions. It will do exactly what the issue says, including the dumb parts. Your leverage is the quality of the ticket and the rigor of the review. Vague issue in, vague PR out.
A good issue has four parts: a goal, the files involved, a definition of done, and a do-not-touch list. That is the whole skill. If you already write good tickets, you are halfway there. If your tickets are one-liners, this is your excuse to fix that.
Want the same delegation mindset in other tools? See our Cursor tutorial and Claude Code automation workflows.
Prompt patterns that raise your hit rate
Three habits separate good agent PRs from bad ones. First, state constraints as a negative list: files not to touch, dependencies not to add, behavior not to change. Agents wander when boundaries are implied. Second, ask for evidence: "list the commands you ran and their output in the PR description." That makes review faster because you see what was actually verified. Third, split big work into a chain of small issues. A 40-line PR gets a real review. A 900-line PR gets a rubber stamp, and that is how bugs ship.
Also keep a short prompt library in your repo wiki. When a prompt works, save it. After a few weeks you will have a set of reusable issue templates for coverage, linting, docs, and dependency bumps, and your team can all delegate the same way.
7 workflows worth delegating
1. Test coverage backfill
Assign an issue: "Add unit tests for every function in src/utils with under 60 percent coverage. Do not change production code." Easy to review, low risk.
2. Dependency bumps with a changelog check
Prompt: "Upgrade the minor and patch versions in package.json, run the tests, and list any breaking changes you found in release notes." You verify the notes, not the typing.
3. Terraform and Kubernetes lint fixes
Point it at your linter output: "Fix every tflint warning in modules/network. One commit per module." Combine with a path-specific instructions file so it respects your conventions.
4. Security finding remediation
Paste a SAST finding into an issue: "Fix the SQL injection in db/queries.py line 88 using parameterized queries and add a regression test." Always read the diff yourself, since security fixes are where plausible but wrong code hurts most.
5. Runbook and README updates
"Update docs/deploy.md to match the current GitHub Actions workflow. List any steps that no longer exist." Documentation drift is the perfect low-stakes task.
6. CI failure triage
Comment on a failing PR: @copilot the integration job fails on timeout. Find the slow test, explain why, and propose a fix. Even when you reject the fix, the diagnosis saves time.
7. Draft PR first pass on small features
Scope it tightly, such as one endpoint with one test. Ask it to leave TODO notes instead of guessing. Then iterate with review comments, the same way you would with a teammate.
Safety and gotchas
Know the limits so they do not surprise you. Per the docs, a session is capped at 59 minutes, works on one branch per task, cannot change multiple repositories in one run, and does not play well with some branch protection rules. It also only works with GitHub-hosted repos.
On the security side: never put secrets in issues or instructions files, keep required reviews on, and require CI to pass before merge. Do not auto-merge agent PRs. For compliance teams, the PR trail is a feature: every change has an author, a diff, and a review. Use it.
Usage and cost tips
The cloud agent consumes GitHub Actions minutes plus AI credits, and stays free of extra charges while you are inside your included allotment. Keep tasks small and well scoped, because a vague task that wanders burns credits and returns a worse PR. Use a cheaper model for chat questions and save the agent for work that deserves a PR. Check your usage page weekly for the first month until you know your baseline.
FAQ
Is the Copilot coding agent free?
It is available on paid plans. Usage draws on included Actions minutes and AI credits, and overage is billed beyond that.
What is the difference between agent mode and the cloud agent?
Agent mode runs in your editor while you watch. The cloud agent runs on GitHub in the background and hands you a pull request.
Can Copilot replace code review?
No. Treat its output as untrusted until a human reviews the diff and CI passes.
Next step
Pick one boring issue in your backlog today, write it with a goal, files, done-when, and do-not-touch, and assign it to Copilot. Want to go deeper on AI for DevOps and security careers? Explore our courses.
