GitHub made it possible to trigger Copilot automations from a comment on 4 August.
Comment on an issue, an agent starts working. It is the lowest-friction way yet to hand a task to an agent, and that is both the feature and the concern.
Why it is genuinely useful
The gap between noticing a problem and doing something about it is where most small work dies. A comment closes that gap to nothing — you are already in the issue, describing the problem, so describing it is the trigger.
It also puts the trigger where non-developers already are. A product manager who can comment on an issue can start a task without learning a separate tool.
The part to think about
A comment is a new execution entry point. On a public repository, or one with broad write access, the people who can comment are not always the people you would give the ability to start a job.
This is worth checking this week:
- Who can comment on your repositories, and is that the same set you would trust to start an automation?
- What permissions do the triggered automations run with — can they open a PR, or merge one?
- Is there an audit trail showing who triggered what?
Read it alongside July's security work
GitHub tightened two supply-chain defaults on 28 July, holding suspicious workflows for approval. This feature moves in the other direction — it makes it easier to start things.
Neither is wrong. But convenience and control are being shipped by the same team in the same fortnight, and only one of them is on by default in a way that protects you.