To add AI code review to an existing workflow, configure the feature provided by your code host: GitHub Copilot code review for pull requests or GitLab Duo for merge requests. Choose whether reviews are requested manually or run automatically, add project-specific instructions, and keep human review and existing merge protections in place. For private code, check the data-processing terms that apply to your exact plan or deployment before enabling a reviewer.
Choose the review workflow that fits your host
| Option | How reviews are triggered | Distinct setup considerations |
|---|---|---|
| GitHub Copilot code review | Manual requests or automatic reviews; automatic reviews can be configured for drafts and new pushes. | Personal automatic reviews have plan or license requirements. Repository and organization settings and rulesets provide additional controls. |
| GitLab Duo reviewer | Assign GitLab Duo to an individual merge request or configure automatic reviews at project, group, or instance scope. | Automatic-review exceptions include draft merge requests, requests with no changes, and requests matching exclusions. |
| GitLab Duo Code Review Flow | An agentic flow runs as a CI/CD job. | Requires group enablement, an eligible project role, and a configured or hosted runner with the required capabilities. |
GitHub uses pull requests; GitLab calls the equivalent collaboration object a merge request (MR). The GitLab reviewer and Code Review Flow are different options, with different prerequisites.
Set up GitHub Copilot code review
Enable automatic reviews
- Open your Copilot settings and select Code review.
- Enable Automatic Copilot code review.
- Choose separately whether to review draft pull requests and each new push.
GitHub lists personal automatic review for Copilot Pro, Pro+, and Max, or a Copilot Business or Enterprise license. It is unavailable for managed user accounts. Repository and organization rulesets can also request Copilot reviews; overlapping settings result in one review rather than duplicate reviews.
At repository scope, administrators can configure behavior under Repository settings → Copilot → Code review. Organization owners can set defaults across repositories, and enterprise-level rulesets can target organizations and repositories and require a review.
#1 Best Overall
Review timing matters: without the new-push option, GitHub says a pull request is reviewed only once. Draft reviews can provide feedback before human review is requested. GitHub also notes that a re-review may repeat comments that were previously dismissed or downvoted.
Choose review effort and add instructions
GitHub describes Lite as a standard, targeted review and Balanced as deeper analysis of complex logic, security-sensitive code, and cross-service changes. Balanced can use more AI credits and marginally more GitHub Actions minutes. Max appeared as “Coming soon” in the reviewed configuration documentation, so do not assume it is generally available.
Add repository-wide instructions in .github/copilot-instructions.md, and use path-specific instructions when different directories have different standards. For example, you can tell the reviewer to apply a security checklist to a sensitive path. GitHub reads instructions and skills from the pull request’s head branch, allowing proposed instruction changes to be evaluated within that pull request.
Set up GitLab Duo reviews
Request the non-agentic review
- Open the merge request you want reviewed.
- Assign
@GitLabDuoas a reviewer, or enter/assign_reviewer @GitLabDuoin a comment.
To automate reviews more broadly, configure them at project, group, or instance scope. Settings cascade, with the more specific setting taking precedence. Draft MRs, MRs with no changes, and MRs matching exclusion rules are exceptions to automatic review; an excluded MR can still be reviewed manually.
Free tools Windows power users keep installed
One-click scans. No signup required.
Enable the agentic Code Review Flow
- Confirm that the project meets the relevant GitLab Duo Agent Platform prerequisites.
- For the top-level group, enable Allow foundational flows and Code Review.
- Ensure you have Developer, Maintainer, or Owner access on the project.
- Configure a runner with the
gitlab--duotag and a Docker-capable executor, or enable hosted runners. - Consider adding an agent configuration file so the flow has project toolchain and dependency context.
The flow runs as a CI/CD job, so runner configuration is part of enabling it rather than an optional refinement.
Add merge-request instructions
GitLab supports custom merge-request review instructions. For Code Review Flow, GitLab recommends an agent configuration file to provide project-specific toolchain and dependency context. Tailor instructions to your conventions and the changes you want reviewers to scrutinize; concise, specific guidance is more actionable than a generic request to find every possible problem.
Rank #3
Check code context and privacy before enabling reviews
For its non-agentic reviewer, GitLab documents the MR title, description, original contents of changed files, diffs, filenames, and custom instructions as context sent to the large language model. Check that context against your organization’s data policies before enabling the feature for private code. GitLab describes prompt guardrails, including structured prompts, context boundaries, and filtering tools, as ways to reduce sensitive-data exposure and prompt-injection risk; those measures do not establish that sending code is risk-free.
The cited GitHub setup documentation does not settle code-review-specific retention and processing terms for every plan or deployment. Check the current terms for the organization and plan you intend to use rather than assuming that all configurations handle private code identically.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Roll out reviews without weakening merge controls
- Start with a limited scope. Choose a small set of repositories, then begin with manually requested or draft reviews if you want the team to evaluate feedback before it becomes routine.
- Tune instructions and exclusions. Use project standards to make feedback relevant, and exclude irrelevant file context where the platform allows it.
- Review comments against the change. Ask reviewers to compare findings with the diff and project standards, resolve valid issues, and note recurring false positives so instructions can be improved.
- Expand automation deliberately. Once the team is comfortable with the feedback, enable automatic coverage and choose whether drafts or each new push should trigger another review.
- Retain existing human approval and branch protections. AI feedback is an input to review, not a replacement for the people and merge checks responsible for approving changes.
GitHub approvals require explicit configuration and remain a public preview in the cited documentation. GitLab states that its Security Review Flow results are “AI-generated and are advisory input, not an authoritative or complete security assessment.” Treat security findings as prompts for investigation, not proof that code is safe or unsafe.
Rank #4
Know how reviews can fail or lose context
For GitLab Duo Code Review, a large MR can exceed the selected model’s context window. The documented fallback retries without the original file contents, which reduces context and may make feedback less specific; a second failure returns a generic error. GitLab recommends smaller MRs and excluding irrelevant file context to reduce the risk. Its documented AI Gateway request timeout for this review is 120 seconds.
On GitHub, review effort and review timing are separate controls: changing automatic-review behavior does not remove the selected effort level for manual requests. Check both settings when troubleshooting a review that did not run as expected or whose depth differs from what you intended.
Choose based on workflow, not a promised accuracy gain
Neither platform’s setup documentation establishes a general defect-detection rate, productivity increase, or time saving. Compare the controls that matter to your team: host and plan access, manual versus automatic triggers, draft and new-push behavior, project instructions, role and runner prerequisites, code context sent to a model, and the data-processing terms for your deployment. Preserve your existing merge requirements regardless of which option you choose.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
