[chaitanyagiri]

What & why

Request Copilot reviews of open human-authored, non-draft pull requests once a day at 09:00 UTC, using a personal access token belonging to the account with Copilot Max. Copilot posts its review findings and overview directly on each PR asynchronously.

The workflow skips unchanged, already-reviewed heads and pending Copilot requests, supports manual dispatch, paginates API results, and surfaces failures without abandoning the remaining batch. It never checks out or executes contributor code. Bot-authored PRs are excluded because their reviews can be billed to the organization.

This is a CI-only change with no UI; requesting the maintainer's no-visual-change waiver.

Activation required: merge this PR and add the COPILOT_REVIEW_TOKEN Actions repository secret, using a fine-grained PAT from the account with Copilot Max, scoped to this repository with Pull requests: Read and write permission. Organization approval and policies may apply. This session cannot inspect repository secrets: the installation returned HTTP 403 for secret listing. No review runs have been triggered.

Usage defaults to the requesting account but can be overridden by organization billing settings. The first run includes the entire eligible open backlog, with no review cap. GitHub schedules may be delayed. Each review consumes credits and Actions usage may apply. Disable overlapping built-in automatic review rules if reviews should run only in this batch.

Type of change

• Bug fix
• New feature
• Refactor / cleanup
• Docs
• Build / CI

Evidence

Before

No daily Copilot review workflow existed in .github/workflows; reviews required a separate manual request or automatic-review ruleset.

After

.github/workflows/daily-copilot-review.yml defines the daily schedule and manual trigger. The workflow body is exercised directly by regression tests:

node --test test/daily-copilot-review.test.cjs
tests 7
pass 7
fail 0

Tests cover the schedule and credential wiring, new and changed PRs, drafts and bot exclusions, completed/pending duplicate suppression, Copilot login variants, error reporting with batch continuation, and bot credential rejection.

How I tested it

• OS: Linux
• node --test test/daily-copilot-review.test.cjs - 7 passed.
• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7 .github/workflows/daily-copilot-review.yml - passed.
• git diff --cached --check - passed before committing.
• Application typecheck/build/full tests were not run: application code and dependencies are unchanged.
• Live review requests were not made, to avoid consuming credits without separate run approval and the subscriber's token.

Credit (optional)

Discord:

X:

Checklist

• Before and after evidence is attached above, under both headings. CI-only: requesting no-visual-change.
• npm run typecheck passes. Not run; no application changes.
• npm run test:focused passes. Targeted workflow regression tests passed.
• npm run build succeeds. Not run; no application changes.
• This PR is one change.
• I read the diff myself, and there is no debug output or unrelated formatting churn.
• No new UI or art.

[github-actions]

🚫 This PR is missing its before/after evidence

Every pull request here has to show its work. Screenshots or a short screen recording, before the change and after it.

• Before — no image or video under that heading
• After — no image or video under that heading

How to fix it: edit the description, keep the ### Before and ### After headings from the template, and drag an image or video under each. GitHub uploads it inline. This check re-runs the moment you save.

A bug fix with no visible surface still needs it: show the failing behaviour, then the same steps passing. A terminal recording is fine.

Genuinely nothing to show — a CI tweak, a typo, a dependency bump? A maintainer can apply the no-visual-change label. Please don't ask unless it truly has no observable effect.

📖 CONTRIBUTING.md → Evidence is mandatory