Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsSome links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
To let GitHub Copilot work around a rule it cannot satisfy, add Copilot cloud agent to the bypass list of the specific repository ruleset causing the block. Prefer For pull requests only unless the agent has a documented need to push directly. This is a targeted exception—not a switch that removes protections for every rule or every contributor.
GitHub’s November 13, 2025 announcement called the feature “Copilot coding agent”; current documentation calls the relevant asynchronous coding agent “Copilot cloud agent.” The names refer to the same capability in this ruleset context. GitHub’s announcement and current cloud agent documentation describe the feature.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Microsoft Surface Laptop (2026), 13.8-inch Premium Performance Laptop, Snapdragon X2 Elite... | $1,523.71 | Buy on Amazon |
Why Copilot may need a ruleset bypass
Rulesets can enforce requirements such as signed commits, permitted commit authors, commit-message formats, required status checks, pull-request protections, and push restrictions. GitHub says Copilot cloud agent cannot sign commits, and rules restricting permitted commit authors can prevent it from creating or updating pull requests. Adding the agent to the relevant ruleset lets it bypass that ruleset’s requirements without removing them for everyone else. The exception does not make its commits signed or satisfy the underlying requirement; it exempts the authorized agent from that ruleset’s enforcement for the allowed operation. GitHub’s feature announcement explains these incompatibilities.
What the bypass does—and does not do
A bypass is attached to an individual ruleset. Copilot must be added to each applicable ruleset; it is not automatically exempt from all repository rules or from policies enforced elsewhere. Human contributors remain subject to the ruleset unless they have their own bypass permissions. GitHub lists Copilot cloud agent as an eligible actor for branch, tag, and push rulesets. GitHub’s repository ruleset documentation describes the supported types and configuration.
#1 Best Overall
- A PREMIUM PERFORMANCE LAPTOP — Ready for work, school, and creativity. Built for busy days, big projects, and nonstop multitasking. Run video calls, school and work apps, 20+ browser tabs, and AI tools at the same time without slowing down.
- WITH AI BUILT IN — With a dedicated AI chip (Qualcomm Snapdragon X2 Elite), this Copilot+ PC[5] on Windows 11 helps you work smarter and faster. Prompt, create, and automate with ease - ready for even your most demanding tasks.
- A 13.8" TOUCHSCREEN YOU'LL ACTUALLY USE — Sharp colors, real detail, smooth 120Hz scrolling on the PixelSense touchscreen[1] with LCD display[2]. Tap, scroll, or pinch to zoom - whichever feels right for streaming, editing photos, or daily work.
- 20 HOURS OF BATTERY (LEAVE THE CHARGER) — Up to 20 hours of video playback[3] on a single charge. Work from a coffee shop, take it to class/work, or binge an entire season on a long flight — it'll keep up.
- THE PORTS YOU NEED — Two USB-C / USB4[4] ports for fast charging, big file transfers, or hooking up to three 4K monitors when you want a full desktop. Wi-Fi 7 keeps you online and fast wherever you are.
It also does not approve a pull request, guarantee that code is correct or secure, or grant permission to merge. Agent access, bypass scope, review, merge authorization, and application security are separate controls. Retain compatible checks, human review, and deployment approvals as required by your policy.
Prerequisites and scope
- You need repository administrator access or a custom role with the edit repository rules permission to manage repository rulesets. Organization- and enterprise-level rulesets are administered at their respective scopes; repository access alone may not let you change an inherited policy.
- The repository must be hosted on GitHub, and Copilot cloud agent must be available and enabled for the relevant user, organization, and repository. Being able to use Copilot does not by itself grant permission to edit rulesets. GitHub’s cloud agent documentation covers repository availability.
- Identify the particular active ruleset and operation that block the task before granting an exception. A classic branch protection rule or another policy layer may be responsible instead.
- Rulesets are available in public repositories on GitHub Free and in public and private repositories on Pro, Team, and Enterprise Cloud; organization rulesets require an applicable organization plan. Confirm current eligibility in GitHub’s ruleset documentation.
Add Copilot cloud agent to a ruleset
- Open the repository on GitHub and go to Settings → Rules → Rulesets.
- Open the ruleset that governs the blocked operation, or select New ruleset. For a new branch or tag ruleset, choose New branch ruleset or New tag ruleset; for push restrictions, choose New push ruleset. Set its target and rules deliberately.
- Under Bypass list, select Add bypass.
- Search for and select Copilot cloud agent, then choose Add Selected.
- Choose For pull requests only unless direct-push bypass is necessary and approved. Select Create for a new ruleset, or save the changes to an existing one.
For a push ruleset, treat this as a broader decision: GitHub says push-ruleset bypass permissions can apply across the repository’s entire fork network, not just one branch in the repository. Review the ruleset scope before saving.
Choose the narrowest workable bypass
| Option | Effect | When to use it |
|---|---|---|
| For pull requests only | Requires the actor to use a pull-request workflow rather than directly pushing changes under the bypass. | Recommended when the goal is to let Copilot propose changes while retaining a review and audit trail. |
| Always allow | Allows the actor to bypass the ruleset for applicable operations, potentially including direct pushes. | Use only when a documented workflow requires it and the broader permission is acceptable. |
GitHub describes the pull-request-only setting as requiring a pull request. It is a least-privilege choice, not a guarantee that other protections, checks, or approval requirements will behave as intended. See GitHub’s bypass configuration details.
Recommended Free Tools
Before activating a policy, consider setting the ruleset to Evaluate to monitor would-be violations without enforcing it. Rulesets also support Active (enforced) and Disabled (neither enforced nor evaluated). GitHub documents these enforcement modes and ruleset insights.
Verify the configuration
- Check that the ruleset targets the branch, tag, or push operation involved in the agent task.
- Confirm that Copilot cloud agent appears in that ruleset’s bypass list and that its mode matches the intended workflow.
- Assign a small, low-risk task and check whether the agent can create or update its branch and pull request.
- Verify that compatible required checks, human approvals, CODEOWNERS review, security scans, and deployment gates still apply.
- Review ruleset insights and organization audit events for relevant activity. GitHub’s organization audit-log reference includes events for ruleset bypass actors being added, removed, or updated: Audit log events for your organization.
Troubleshoot a missing or ineffective bypass
Copilot cloud agent is missing from the selector
- Confirm you are editing a supported branch, tag, or push ruleset on GitHub.com.
- Check that you have permission to edit the ruleset and that it is not controlled at an organization or enterprise level.
- Confirm cloud agent is available and enabled for the relevant user, organization, and repository. GitHub says the cloud agent works only with repositories hosted on GitHub and may be unavailable where explicitly disabled. Check the cloud agent availability guidance.
The agent is still blocked
Inspect every active ruleset that targets the relevant branch, tag, or push operation. A bypass in one ruleset does not override a conflicting rule in another. Also check whether the block comes from classic branch protection, an organization or enterprise policy, a ruleset targeting a different ref, required checks, or missing repository access. If the bypass is pull-request-only but the workflow requires a direct push, that restriction is expected.
A pull request opens but Copilot cannot update it
Check the rules governing both the working branch and the target branch, along with commit-author or metadata restrictions. GitHub notes that incompatible rules can prevent the agent from creating or updating pull requests. Review the cloud agent’s ruleset guidance.
The task fails for a reason unrelated to rulesets
Once ruleset conflicts are ruled out, check Copilot access, Actions capacity, network allowlists, billing or runtime errors. GitHub documents a maximum session duration of 59 minutes; it cannot be extended or bypassed, and the agent works on one branch at a time and opens one pull request per assigned task. These limits can explain incomplete work without indicating a ruleset problem. See GitHub’s cloud agent limits.
For self-hosted or larger runners using Azure private networking, GitHub’s network endpoint change took effect February 27, 2026. The documented endpoints are api.business.githubcopilot.com for Copilot Business, api.enterprise.githubcopilot.com for Copilot Enterprise, and api.individual.githubcopilot.com for Copilot Pro and Pro+. This specific runner configuration change does not affect every repository: GitHub says to check .github/workflows/copilot-setup-steps.yml; repositories without that file are not affected by this change. Read GitHub’s network configuration notice.
Quick Recap
Security and governance checks
- Commit provenance: If signed commits or an author allowlist are compliance requirements, decide explicitly whether an agent exception is permissible. The bypass does not change the commit’s signature or authorship.
- Review and merge: Keep human approval and compatible automated checks in place where required. A bypass only addresses ruleset enforcement for the authorized actor; it is not a code-quality or security review.
- Source visibility: Do not assume Copilot’s standard content exclusions restrict cloud agent. GitHub says cloud agent can see and update excluded files. Review GitHub’s content-exclusion guidance for assigning tasks to Copilot.
- Blast radius: Prefer a narrowly targeted repository ruleset over a broad organization, enterprise, or push-ruleset exception. Push bypass scope may extend across the fork network.
- Auditability: Record why the exception exists, who approved it, and which ruleset it covers; monitor the organization audit log for bypass-actor changes.
When to use an alternative
- Redesign the rule if the policy can distinguish agent working branches from protected production branches without weakening human protections.
- Use a dedicated branch pattern when Copilot needs room to prepare changes but production branches must retain stricter controls.
- Keep a human-mediated workflow when every commit must meet signing, provenance, or approval requirements and no exception is acceptable.
- Leave the agent disabled if organizational policy does not permit it to access source files or bypass the affected control.
- Use deterministic automation, such as a custom GitHub App or Actions workflow, if the requirement is controlled commit identity or signing rather than an interactive coding-agent workflow. This alternative requires engineering and permission design of its own.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
