Use Copilot code review as a claim to investigate, not an approval
Inspect each suggested issue against the diff, test the relevant behaviour and retain human responsibility for the change.
In brief
Copilot can point out possible issues in a code change. Treat each comment as a review lead: confirm the affected path and evidence before accepting a patch or dismissing it.
This can help find a missed case without turning a generated comment into a mandatory code change.
Ask what would trigger the issue
Identify input, state and expected behaviour. If the comment claims a null path exists, inspect callers and the contract. If it suggests a performance fix, examine the real workload rather than adding complexity because it sounds efficient.
Review the suggested patch
Check whether it changes authorization, escaping, error handling or user-visible behaviour. Test the actual boundary case rather than a test mirroring the patch. Avoid accepting large unrelated edits as the price of fixing a small issue.
Keep accountability and scope
Summarize the verified issue and validation in the review. Preserve repository instructions and human approval rules. Do not describe an AI review as a hands-on security test or claim a measured speedup unless that measurement was actually performed.
Before you act
AI review can miss real bugs and flag nonissues. Feature access and behaviour depend on the configured product; a clean review is not a security audit.
What to do next
- Read the actual diff and the context of each comment.
- Reproduce or reason through the stated failure with a relevant check.
- Apply a justified fix, inspect its new diff and run appropriate tests before merging.
