Copilot Code Review for Azure DevOps

Automated pull request code reviews powered by the official GitHub Copilot CLI or Claude Code CLI. Get automated feedback on your PRs while leaving your code hosted in Azure DevOps repos.

Overview

This Azure DevOps extension provides a pipeline task that automatically reviews pull request code changes using GitHub Copilot or Claude Code. When triggered, the task:

1. Fetches pull request details, changed files, and linked work item details from Azure DevOps
2. Invokes the configured CLI agent (GitHub Copilot or Claude Code) to analyze the changes
3. Posts review comments directly to the pull request

This brings AI-powered code review capabilities to Azure DevOps, helping teams improve code quality through AI-assisted reviews.

Prerequisites

This extension supports Windows and Linux Azure DevOps agents. Compatible with MS-hosted and self-hosted agents. Before using, ensure you have:

• AI Agent (one of the following):
  • GitHub Copilot (default): An active GitHub Copilot subscription and a GitHub PAT with Copilot access permissions
  • Claude Code: An Anthropic API key with access to Claude Code
• Azure DevOps Authentication (one of the following):
  • System Access Token (Recommended): Use the pipeline's built-in OAuth token for Azure DevOps Services. Must grant permissions to Build Service Identity (see below).
  • Personal Access Token: Required for Azure DevOps Server (on-prem) or if you prefer explicit token management. Needs permissions to read pull requests, write comments, and read code.
• PowerShell 7+: This extension requires PowerShell 7 or later (pwsh) to be installed on the agent. PowerShell 7 is pre-installed on Microsoft-hosted agents.

Installation

1. Install the extension from the Azure DevOps Marketplace
2. Navigate to your Azure DevOps organization settings
3. Go to Extensions and verify the extension is installed

Usage

Using System Access Token

The recommended approach for Azure DevOps Services uses the pipeline's built-in System Access Token and a personal access token for a GitHub account with Copilot access:

trigger: none

pool:
  vmImage: 'ubuntu-latest'  # or 'windows-latest'

steps:
- checkout: self
  fetchDepth: 0

- task: CopilotCodeReview@1
  displayName: 'Copilot Code Review'
  inputs:
    githubPat: '$(GITHUB_PAT)'
    useSystemAccessToken: true

IMPORTANT: When using useSystemAccessToken, ensure the Build Service identity has "Contribute to pull requests" permission on your repository. See Granting Build Service Permissions below.

Using Personal Access Token

For Azure DevOps Server (on-prem) or if you prefer explicit token management:

trigger: none

pool:
  vmImage: 'ubuntu-latest'  # or 'windows-latest'

steps:
- checkout: self
  fetchDepth: 0

- task: CopilotCodeReview@1
  displayName: 'Copilot Code Review'
  inputs:
    githubPat: '$(GITHUB_PAT)'
    azureDevOpsPat: '$(AZURE_DEVOPS_PAT)'

Using Claude Code CLI

To use Claude Code instead of GitHub Copilot, enable useClaudeCode and provide an Anthropic API key:

trigger: none

pool:
  vmImage: 'ubuntu-latest'  # or 'windows-latest'

steps:
- checkout: self
  fetchDepth: 0

- task: CopilotCodeReview@1
  displayName: 'Claude Code Review'
  inputs:
    useClaudeCode: true
    anthropicApiKey: '$(ANTHROPIC_API_KEY)'
    useSystemAccessToken: true
    model: 'claude-sonnet-4-6'
    maxTurns: '50'
    maxBudget: '5.00'

NOTE: Claude Code CLI is installed automatically via npm install -g @anthropic-ai/claude-code. Node.js is available on all Azure DevOps agents. Output is streamed to the pipeline logs in real time.

Set Trigger

Use branch policies on your protected branches to specify the pipeline as a build validation that must finish before the PR can be completed:

With Custom Prompt

You can customize the review prompt to focus on aspects tailored to your needs:

- task: CopilotCodeReview@1
  displayName: 'Copilot Code Review'
  inputs:
    githubPat: '$(GITHUB_PAT)'
    useSystemAccessToken: true
    prompt: |
      Review this code focusing only on:
      - Security vulnerabilities
      - Performance bottlenecks
      - Code simplification
      Avoid lengthy explanations, keep comments concise and direct.

For longer custom prompts, create a .txt file in your repository and pass the file path as a task input:

- task: CopilotCodeReview@1
  displayName: 'Copilot Code Review'
  inputs:
    githubPat: '$(GITHUB_PAT)'
    useSystemAccessToken: true
    promptFile: '$(Build.SourcesDirectory)/.copilot/review-prompt.txt'

IMPORTANT: If using a custom prompt, avoid including any double quotation marks (") as this will cause errors when passing the input to the Copilot CLI. Single quotes (') can be used instead and should not cause any issues.

Manual Trigger for Specific PR

If you don't want to setup an automatic trigger, you can instead set up a pipeline with a Pull Request ID parameter to run reviews on demand:

parameters:
  - name: pullRequestId
    displayName: 'Pull Request ID'
    type: string
    default: ''

trigger: none

pool:
  vmImage: 'ubuntu-latest'

steps:
  - checkout: self
    fetchDepth: 0

  - task: CopilotCodeReview@1
    displayName: 'Copilot Code Review'
    inputs:
      githubPat: '$(GITHUB_PAT)'
      useSystemAccessToken: true
      pullRequestId: '${{ parameters.pullRequestId }}'

Input Reference

Copilot Models

As of April 2026, here are the model options supported by the GitHub Copilot CLI:

• claude-sonnet-4.5 (default)
• claude-haiku-4.5
• claude-opus-4.5
• claude-sonnet-4
• gpt-5.2-codex
• gpt-5.2
• gpt-5.1-codex-max
• gpt-5.1-codex
• gpt-5.1-codex-mini
• gpt-5.1
• gpt-5
• gpt-5-mini
• gpt-4.1
• gemini-3-pro-preview

Claude Code Models

As of April 2026, here are the model options supported by the Claude Code CLI:

Aliases always point to the latest version. To pin to a specific version, use the full model name (for example, claude-opus-4-6).

Author Filtering

Use the authors input to limit code reviews to PRs created by specific users. This is useful when you want to:

• Only review code from certain team members (e.g. junior developers)
• Exclude automated bot PRs from review
• Limit Copilot usage to a subset of contributors
• Use separate prompts/models for certain team members

- task: CopilotCodeReview@1
  displayName: 'Copilot Code Review'
  inputs:
    githubPat: '$(GITHUB_PAT)'
    useSystemAccessToken: true
    authors: 'alice@example.com, bob@example.com, charlie@example.com'

When configured:

• The task compares $(Build.RequestedForEmail) against the provided email list
• If the PR author's email matches any in the list, the review proceeds normally
• If no match is found, the task completes successfully without running the code review
• Email comparison is case-insensitive

Setting Up Authentication

Option 1: System Access Token (Recommended)

The system access token is the Microsoft-recommended authentication method for Azure DevOps Services. It uses OAuth and requires no PAT management.

Granting Build Service Permissions

The Build Service identity needs permission to contribute to pull requests:

1. Navigate to Repos
2. From the repository dropdown, go to Manage repositories
3. Go to the Security tab
4. Find the [Project Name] Build Service ([Org Name]) identity
5. Set Contribute to pull requests to Allow

TIP: If you don't see the Build Service identity, run a pipeline first to ensure it's been created.

Option 2: Personal Access Token

Create a personal access token:

1. Navigate to User settings > Personal access tokens
2. Click New token
3. Click Show all scopes
4. Create a new token with the following scopes:
   • Code: Read
   • Pull Request Threads: Read & Write
5. Store the token as a secret variable in your Azure DevOps pipeline

NOTE: When using a PAT, PR comments will be attributed to the account that created the PAT. For large teams, consider using a dedicated service account.

GitHub Personal Access Token (for Copilot CLI)

1. Go to GitHub Settings > Developer Settings > Personal Access Tokens
2. Generate a new Fine-grained token with the following options:
   • Repository access: Public
   • Permission: Copilot Requests
3. Store the token as a secret variable in your Azure DevOps pipeline

IMPORTANT: If your user account is part of a GitHub organization, ensure the organization admin goes to GitHub Policies > Copilot > Copilot CLI and sets the policy to Enabled everywhere

Anthropic API Key (for Claude Code CLI)

1. Go to Anthropic Console
2. Create an API key
3. Store the key as a secret variable in your Azure DevOps pipeline (e.g., ANTHROPIC_API_KEY)

Storing Tokens in Azure DevOps

1. Navigate to Pipelines > Library
2. Create a new Variable Group or edit an existing one
3. Add the relevant variables:
   • GITHUB_PAT (mark as secret) — for Copilot CLI
   • ANTHROPIC_API_KEY (mark as secret) — for Claude Code CLI
   • AZURE_DEVOPS_PAT (mark as secret) — if not using System Access Token
4. Link the variable group to your pipeline

Alternatively, you can create the pipeline first and then configure the pipeline-specific variables.

How It Works

1. Install CLI Agent: The task ensures the configured CLI agent is installed on the build agent. GitHub Copilot CLI is installed via winget (Windows) or the official install script (Linux). Claude Code CLI is installed via npm install -g @anthropic-ai/claude-code.
2. Fetch PR Context: The task retrieves pull request metadata, existing comments, iteration details, and linked work item details via the Azure DevOps API
3. Run Code Review: Using the PR context and local Git commands, the CLI agent analyzes the changes using the configured or default prompt
4. Post Comments: Review findings are posted as comments on the pull request via the Azure DevOps API

Default Review Focus Areas

The default prompt instructs Copilot to focus on:

• Performance: Identifying inefficient code patterns
• Best Practices: Adherence to coding standards
• Reusability: Opportunities for code reuse
• Maintainability: Code clarity and documentation
• Simplification: Reducing complexity
• Security: Potential vulnerabilities
• Code Consistency: Style and pattern consistency

Limitations

• GitHub Copilot CLI: On Windows, requires winget to be available. On Linux, requires curl and bash (standard on most systems). If using MS-hosted agents, these should be available by default.
• Claude Code CLI: Requires npm to be available (pre-installed on all Azure DevOps agents). Requires an Anthropic API key.
• General Comments Only: Posts general PR comments (file-level inline comments not yet supported)
• Context Window: Very large PRs may exceed the agent's context limits

Troubleshooting

Task fails with "GitHub Copilot CLI not found"

• Windows: Ensure your agent can access winget and has internet connectivity to install the Copilot CLI.
• Linux: Ensure curl and bash are available, and the agent has internet connectivity to download from https://gh.io/copilot-install.

Task fails with "Claude Code CLI not found"

• Ensure npm is available on the agent and the agent has internet connectivity to install @anthropic-ai/claude-code from npm.
• On self-hosted agents, ensure the agent user has permission to install global npm packages.

Authentication errors

Verify that:

• Your GitHub PAT has Copilot access
  • If your user account is part of a GitHub organization, ensure the organization admin goes to GitHub Policies > Copilot > Copilot CLI and sets the policy to Enabled everywhere
• If using azureDevOpsPat:
  • Your Azure DevOps PAT has Code (Read) and Pull Request Threads (Read & Write) permissions
  • The token is not expired
• If using useSystemAccessToken:
  • The Build Service identity has "Contribute to pull requests" permission on the repository
  • Try explicitly mapping the SYSTEM_ACCESSTOKEN environment variable:

- task: CopilotCodeReview@1
  displayName: 'Copilot Code Review'
  inputs:
    githubPat: '$(GITHUB_PAT)'
    useSystemAccessToken: true
  env:
    SYSTEM_ACCESSTOKEN: $(System.AccessToken)

Timeout errors

For large PRs, increase the timeout input value. The default is 15 minutes.

No comments posted

Check the pipeline logs for Copilot's analysis output and determine if the agent experienced connectivity issues when posting comments. Even if Copilot finds no issues, it should still post a single comment indicating the PR looks good when using the default prompt.

Contributing

Contributions are welcome! Please feel free to submit issues or pull requests on GitHub.

License

This project is licensed under GNU General Public License v3 - see the LICENSE file for details.

Support

For issues and feature requests, please use the GitHub Issues page.

Acknowledgments

• Built with Azure Pipelines Task SDK
• Powered by GitHub Copilot and Claude Code

Disclaimers

• This project is not affiliated with or endorsed by Azure, GitHub, Anthropic, or the Microsoft Corporation.
• All responses and interactions generated by GitHub Copilot or Claude Code remain subject to the probabilistic nature of the underlying LLM. As with all LLM-based interactions, there is a non-zero chance of unpredictable results. Use at your own discretion.