feat(rulesets): add automatic Copilot code review for gitflow develop branch - #60
Merged
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
Adds an org-level GitHub ruleset to automatically request Copilot code review for PRs targeting the develop branch, scoped only to repositories opted into the existing gitflow custom property. This aligns with the repo’s governance-as-code approach by centrally managing a targeted review automation rule via Terraform.
Changes:
- Introduces
github_organization_ruleset.org_gitflow_copilot_reviewforrefs/heads/developongitflow=truerepositories. - Adds
org_gitflow_copilot_review_enforcementvariable to control enforcement mode for the new ruleset.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| variables.tf | Adds enforcement variable + documentation for the new gitflow Copilot review ruleset. |
| rulesets.tf | Defines the new organization ruleset that enables Copilot code review for develop on gitflow-tagged repos. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
… branch Adds org-gitflow-copilot-review, scoped to the develop branch on gitflow-tagged repos only (main is release-only, low-volume). Reuses the existing gitflow custom property; no new tagging mechanism. review_on_push is false to cap AI-credit spend at ~1 review per PR.
Per review, the ruleset comment and variable description hard-coded org-specific, time-sensitive billing facts (premium-request count, dollar rate, current seat position, current repo visibility). Those rot in place and contradict the repo convention that code stays org-agnostic and must clone cleanly into another org. Keep the durable rationale -- why develop-only, why review_on_push = false, and that this ruleset bills per review unlike the free native ones. The point-in-time figures stay in the PR body, which is where a dated record belongs.
JacobPEvans-personal
force-pushed
the
feat/gitflow-copilot-review
branch
from
July 17, 2026 03:34
f97b6d5 to
0dd5f3b
Compare
JacobPEvans-personal
added a commit
that referenced
this pull request
Jul 17, 2026
…#67) The Copilot review ruleset from #60 was scoped via the gitflow custom property -- all 9 gitflow-tagged repos, and it grows automatically as more repos opt into gitflow. That ruleset was never applied (tofu apply was left as an operator step and never run), but the org has already exhausted its Copilot review capacity from unrelated usage. With 0 assigned Copilot seats, every review bills AI credits directly with no pooled allowance -- property-based scoping is the wrong shape for a budget that's already tight. Replace it with an explicit (branch, repo-list) target model, mirroring merge-gate.tf's existing for_each-over-buckets pattern rather than inventing a new one. Starting scope: just ansible-proxmox-apps on develop, in the new config/copilot-review.yml. Growing the pilot is a one-line YAML edit, never a broader property match. Since nothing was ever applied, this is a clean replacement: no import, no moved block, no state migration. The enforcement variable is renamed org_gitflow_copilot_review_enforcement -> org_copilot_review_enforcement since it's no longer gitflow-tied (safe -- variables aren't in state). Verified: tofu fmt/validate pass; tflint passes against v0.63.1 (the version CI resolves, via the signature = "pgp" pin from #61/#64).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
github_organization_ruleset.org_gitflow_copilot_review, scoped to thedevelopbranch on gitflow-tagged repos only (mainon gitflow repos is release-only and low-volume, so it's excluded).gitflowcustom property (gitflow.tf) and the samerepository_propertyscoping pattern asorg_gitflow_base/org_gitflow_main/org_gitflow_develop— no new tagging mechanism.copilot_code_reviewrule block already supported by the locked provider version (integrations/github6.13.0, feature shipped in 6.10.0) — no provider bump needed.review_on_push = falseso Copilot reviews once per PR instead of on every push.Cost impact
Not free. Per GitHub's billing docs, each Copilot code review incurs two simultaneous charges:
dryvist) currently has 0 assigned Copilot seats (gh api orgs/dryvist/copilot/billing), so there's no pooled included allowance — usage bills directly to the org.develop-only (not the full 32-repo public fleet, notmain) to bound this exposure.review_on_push = falsecaps it at ~1 review per PR regardless of push count.Test plan
tofu fmt -check -diff— cleantofu init -backend=false && tofu validate— success, confirms thecopilot_code_reviewblock matches the provider schematofu planon Terrakube — expect exactly 1 to add, 0 to change, 0 to destroytofu applygh api orgs/dryvist/rulesetsand confirm a gitflow repo'sdevelopbranch showscopilot_code_reviewin effective rules,maindoes notdevelopand confirm Copilot is requested as reviewer once, not on subsequent pushes