[2026-03-24] Copilot coding agent can push directly to human-created pull requests when @mentioned (#60420)

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: timrogers <116134+timrogers@users.noreply.github.com>
Co-authored-by: Tim Rogers <timrogers@github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Author: 3 people

content/copilot/concepts/agents/coding-agent/about-coding-agent.md

@@ -142,7 +142,9 @@ Security is a fundamental consideration when you enable {% data variables.copilo
   * {% data variables.copilot.copilot_coding_agent %}'s security validation **does not require** a {% data variables.product.prodname_GHAS_cs_or_sp %} license.
 * **Subject to existing governance**: Organization settings and enterprise policies control availability. Any security policies and practices set up for the organization also apply to {% data variables.copilot.copilot_coding_agent %}.
 * **Restricted development environment**: {% data variables.copilot.copilot_coding_agent %} works in a sandbox development environment with internet access controlled by a firewall. It has read-only access to the repository it's assigned to work in.
-* **Limited access to branches**: {% data variables.copilot.copilot_coding_agent %} can only create and push to branches beginning with `copilot/`. It is subject to any branch protections and required checks for the working repository.
+* **Limited access to branches**
+  * {% data variables.copilot.copilot_coding_agent %} only has the ability to push to a single branch. When the agent is triggered by mentioning `@copilot` on an existing pull request, {% data variables.product.prodname_copilot_short %} has write access to the pull request's branch. In other cases, a new `copilot/` branch is created for {% data variables.product.prodname_copilot_short %}, and the agent can only push to that branch.
+  * {% data variables.copilot.copilot_coding_agent %} is subject to any branch protections and required checks for the working repository.
 * **Responds only to users with write permissions**: {% data variables.copilot.copilot_coding_agent %} will not respond to feedback from users with lower levels of access.
 * **Treated as an outside collaborator**
   * Draft pull requests created by {% data variables.copilot.copilot_coding_agent %} must be reviewed and merged by a human. {% data variables.copilot.copilot_coding_agent %} cannot mark its pull requests as "Ready for review" and cannot approve or merge a pull request.
@@ -163,7 +165,7 @@ For more information, see:
 To mitigate this risk, {% data variables.product.github %}:
 
 * **Limits who can assign tasks to {% data variables.copilot.copilot_coding_agent %}.** Only users with write access to the repository can trigger {% data variables.copilot.copilot_coding_agent %} to work. Comments from users without write access are never presented to the agent.
-* **Limits the permissions in access tokens used by {% data variables.copilot.copilot_coding_agent %}.** Pushes are only allowed to branches beginning with `copilot/`. {% data variables.copilot.copilot_coding_agent %} cannot push to the `main` or `master` branches.
+* **Limits the branch that {% data variables.copilot.copilot_coding_agent %} can push to.** The agent only has the ability to push to a single branch. When the agent is triggered by mentioning `@copilot` on an existing pull request, {% data variables.product.prodname_copilot_short %} has write access to the pull request's branch. In other cases, a new `copilot/` branch is created for {% data variables.product.prodname_copilot_short %}, and the agent can only push to that branch.
 * **Limits {% data variables.copilot.copilot_coding_agent %}'s credentials.** {% data variables.copilot.copilot_coding_agent %} can only perform simple push operations. It cannot directly run `git push` or other Git commands.
 * **Restricts {% data variables.product.prodname_actions %} workflow runs.** By default, workflows are not triggered until {% data variables.copilot.copilot_coding_agent %}'s code is reviewed and a user with write access to the repository clicks the **Approve and run workflows** button. Optionally, you can configure {% data variables.product.prodname_copilot_short %} to allow workflows to run automatically. See [AUTOTITLE](/copilot/how-tos/use-copilot-agents/coding-agent/review-copilot-prs#managing-github-actions-workflow-runs). 
 * **Prevents the user who asked {% data variables.copilot.copilot_coding_agent %} to create a pull request from approving it.** This maintains the expected controls in the "Required approvals" rule and branch protection. See [AUTOTITLE](/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets).

content/copilot/how-tos/use-copilot-agents/coding-agent/make-changes-to-an-existing-pr.md

@@ -2,7 +2,7 @@
 title: Asking GitHub Copilot to make changes to an existing pull request
 shortTitle: Update existing PR
 allowTitleToDifferFromFilename: true
-intro: 'You can ask {% data variables.product.prodname_copilot_short %} to make changes to an existing pull request created by a human by mentioning `@copilot`.'
+intro: 'You can ask {% data variables.product.prodname_copilot_short %} to make changes to an existing pull request by mentioning `@copilot`.'
 product: '{% data reusables.gated-features.copilot-coding-agent %}<br><a href="https://github.com/features/copilot/plans?ref_product=copilot&ref_type=engagement&ref_style=button" target="_blank" class="btn btn-primary mt-3 mr-3 no-underline"><span>Sign up for {% data variables.product.prodname_copilot_short %}</span> {% octicon "link-external" height:16 %}</a>'
 versions:
   feature: copilot
@@ -16,13 +16,11 @@ category:
 
 ## Introduction
 
-You can ask {% data variables.product.prodname_copilot_short %} to make changes to an existing pull request created by a human developer by mentioning `@copilot` in a comment.
+You can ask {% data variables.product.prodname_copilot_short %} to make changes to an existing pull request by mentioning `@copilot` in a comment.
 
-{% data variables.product.prodname_copilot_short %} will create a child pull request, using the existing pull request's branch as the base branch.  Once it has finished work on the changes you requested, it requests your review on the child pull request.
+By default, {% data variables.product.prodname_copilot_short %} pushes commits directly to the pull request's branch. Once it has finished work on the changes you requested, it requests your review.
 
-You maintain control of the original pull request: until you accept Copilot's proposed changes by merging its child pull request into your branch, the pull request will remain untouched.
-
-You can ask {% data variables.product.prodname_copilot_short %} to make changes to its child pull request by leaving a review. See [AUTOTITLE](/copilot/using-github-copilot/coding-agent/reviewing-a-pull-request-created-by-copilot).
+If you prefer {% data variables.product.prodname_copilot_short %} to create a separate pull request instead, you can ask for this using natural language in your comment—for example, "open a PR to fix the tests."
 
 ## Asking {% data variables.product.prodname_copilot_short %} to make changes
 
@@ -31,9 +29,7 @@ You can ask {% data variables.product.prodname_copilot_short %} to make changes
 1. Optionally, when leaving a pull request comment (not a review or review comment) through the {% data variables.product.github %} web interface, select a model using the model picker.
 1. Submit your comment or review.
 
-{% data variables.product.prodname_copilot_short %} will open a child pull request, using the existing pull request's branch as the base branch.
-
-{% data variables.product.prodname_copilot_short %} will leave a comment linking to the new pull request. Once the agent finishes work, it will request a review from you.
+If you prefer not to use this default behavior, you can ask {% data variables.product.prodname_copilot_short %} to create a new branch and a new pull request targeting your branch instead. Once the agent finishes work, it will request a review from you.
 
 {% data reusables.copilot.coding-agent.monitoring-progress-heading %}
 

content/copilot/how-tos/use-copilot-agents/coding-agent/review-copilot-prs.md

@@ -26,7 +26,7 @@ After {% data variables.product.prodname_copilot_short %} has finished working o
 > [!IMPORTANT]
 > If you have rules or branch protections that require pull request approvals, and you ask {% data variables.product.prodname_copilot_short %} to create a pull request, you can approve the pull request, but **your approval won't count** toward the required number of approvals. Someone else must approve the pull request for it to be merged.
 
-You can ask {% data variables.product.prodname_copilot_short %} to make changes by mentioning `@copilot` in pull request comments, or you can check out {% data variables.product.prodname_copilot_short %}'s branch and make changes yourself.
+You can ask {% data variables.product.prodname_copilot_short %} to make changes by mentioning `@copilot` in pull request comments. By default, {% data variables.product.prodname_copilot_short %} pushes commits directly to the pull request's branch. If you prefer, you can ask {% data variables.product.prodname_copilot_short %} to create a separate pull request instead by using natural language in your comment. You can also check out {% data variables.product.prodname_copilot_short %}'s branch and make changes yourself.
 
 Optionally, when submitting a pull request comment (not a review or review comment) through the {% data variables.product.github %} web interface, you can select a model using the model picker. By default, {% data variables.product.prodname_copilot_short %} will use the model originally used to create the pull request.
 

content/copilot/responsible-use/copilot-coding-agent.md

@@ -117,7 +117,7 @@ The agent filters hidden characters, that are not displayed on {% data variables
 
 Copilot only has access to the repository where it is creating a pull request, and cannot access other repositories.
 
-Its permissions are limited, allowing it to push code and read other resources. Built-in protections mean that Copilot can only push to branches with names beginning with `copilot/`. This means that Copilot cannot push to your default branch (for example, `main`).
+Its permissions are limited, allowing it to push code and read other resources. Built-in protections mean that Copilot can only push to a single branch: the existing pull request branch when triggered via `@copilot`, or otherwise to a new `copilot/` branch. This means that Copilot cannot push directly to your default branch (for example, `main`).
 
 {% data variables.copilot.copilot_coding_agent %} does not have access to Actions organization or repository secrets or variables during runtime. Only secrets and variables specifically added to the `copilot` environment are passed to the agent.
 

content/copilot/tutorials/coding-agent/get-the-best-results.md

@@ -64,7 +64,7 @@ Issues that you may choose to work on yourself, rather than assigning to {% data
 
 Working with {% data variables.product.prodname_copilot_short %} on a pull request is just like working with a human developer: it's common for the pull request to need further work before it can be merged. The process for getting the pull request to a mergeable state is exactly the same when the pull request is created by {% data variables.product.prodname_copilot_short %} as when it's created by a human.
 
-You can also mention `@copilot` in comments on the pull request—explaining what you think is incorrect, or could be improved—and leave {% data variables.product.prodname_copilot_short %} to make the required changes. Alternatively, you can work on the feature branch yourself and push changes to the pull request.
+You can also mention `@copilot` in comments on the pull request—explaining what you think is incorrect, or could be improved—and {% data variables.product.prodname_copilot_short %} will push commits directly to the pull request's branch. Alternatively, you can work on the feature branch yourself and push changes to the pull request.
 
 After a user with write access mentions `@copilot` in a comment, {% data variables.product.prodname_copilot_short %} will start to make any required changes, and will update the pull request when it's done. Because {% data variables.product.prodname_copilot_short %} starts looking at comments as soon as they are submitted, if you are likely to make multiple comments on a pull request it's best to batch them by clicking **Start a review**, rather than clicking **Add single comment**. You can then submit all of your comments at once, triggering {% data variables.product.prodname_copilot_short %} to work on your entire review, rather than working on individual comments separately.