CCR: Copilot setup steps and firewall support [GA] (#62011)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Author: 3 people

content/copilot/how-tos/copilot-on-github/customize-copilot/customize-cloud-agent/customize-the-agent-environment.md

@@ -29,6 +29,8 @@ You can customize {% data variables.product.prodname_copilot_short %}'s developm
 * [Give {% data variables.product.prodname_copilot_short %} a Windows development environment](#switching-copilot-to-a-windows-development-environment), instead of the default Ubuntu Linux environment
 * [Enable Git Large File Storage (LFS)](#enabling-git-large-file-storage-lfs)
 
+{% data variables.copilot.copilot_code-review_short %} also runs in an ephemeral development environment, and you can customize it in the same ways described in this article. By default, {% data variables.copilot.copilot_code-review_short %} reuses your `copilot-setup-steps.yml` file, but you can also create a dedicated `copilot-code-review.yml` file to configure {% data variables.copilot.copilot_code-review_short %}'s environment independently of {% data variables.copilot.copilot_cloud_agent %}. See [AUTOTITLE](/copilot/how-tos/use-copilot-agents/request-a-code-review/use-code-review#customizing-copilot-code-reviews-environment).
+
 In addition, you can:
 
 * [AUTOTITLE](/copilot/how-tos/copilot-on-github/customize-copilot/customize-cloud-agent/configure-secrets-and-variables)

content/copilot/how-tos/copilot-on-github/customize-copilot/customize-cloud-agent/index.md

@@ -10,7 +10,6 @@ children:
   - /use-hooks
   - /customize-the-agent-environment
   - /configure-secrets-and-variables
-  - /customize-the-agent-firewall
   - /test-custom-agents
 contentType: how-tos
 ---

…ud-agent/customize-the-agent-firewall.md …tomize-copilot/customize-the-firewall.mdcontent/copilot/how-tos/copilot-on-github/customize-copilot/customize-cloud-agent/customize-the-agent-firewall.md renamed to content/copilot/how-tos/copilot-on-github/customize-copilot/customize-the-firewall.md content/copilot/how-tos/copilot-on-github/customize-copilot/customize-cloud-agent/customize-the-agent-firewall.md renamed to content/copilot/how-tos/copilot-on-github/customize-copilot/customize-the-firewall.md

@@ -1,8 +1,8 @@
 ---
-title: Customizing or disabling the firewall for GitHub Copilot cloud agent
-shortTitle: Customize the agent firewall
+title: Customizing or disabling the firewall for GitHub Copilot
+shortTitle: Customize the firewall
 allowTitleToDifferFromFilename: true
-intro: 'Learn how to control the domains and URLs that {% data variables.copilot.copilot_cloud_agent %} can access.'
+intro: 'Learn how to control the domains and URLs that {% data variables.copilot.copilot_cloud_agent %} and {% data variables.copilot.copilot_code-review_short %} can access.'
 versions:
   feature: copilot
 redirect_from:
@@ -12,18 +12,22 @@ redirect_from:
   - /copilot/how-tos/agents/copilot-coding-agent/customize-the-agent-firewall
   - /copilot/how-tos/agents/coding-agent/customize-the-agent-firewall
   - /copilot/how-tos/use-copilot-agents/cloud-agent/customize-the-agent-firewall
+  - /copilot/how-tos/copilot-on-github/customize-copilot/customize-cloud-agent/customize-the-agent-firewall
 contentType: how-tos
 category:
   - Configure Copilot
 ---
 
 > [!NOTE]
-> Firewall configuration has moved to the {% data variables.copilot.copilot_cloud_agent %} settings page. Previous configurations saved as Actions variables will be maintained on that page.
+> Firewall configuration is managed from the "Internet access" settings tab, which covers both {% data variables.copilot.copilot_cloud_agent %} and {% data variables.copilot.copilot_code-review_short %}. Previous configurations saved as Actions variables will be maintained on that page.
 
 ## Overview
 
 By default, {% data variables.product.prodname_copilot_short %}'s access to the internet is limited by a firewall.
 
+> [!NOTE]
+> {% data variables.copilot.copilot_code-review_short %} also supports firewall configuration, at both the organization and repository level, under its own section of the "Internet access" tab described below. This allows you to configure firewall rules for {% data variables.copilot.copilot_code-review_short %} independently of {% data variables.copilot.copilot_cloud_agent %}. See [AUTOTITLE](/copilot/how-tos/use-copilot-agents/request-a-code-review/use-code-review#customizing-copilot-code-reviews-environment).
+
 Limiting internet access helps manage data exfiltration risks. Unexpected behavior from {% data variables.product.prodname_copilot_short %}, or malicious instructions, could lead to code or other sensitive information being leaked to remote locations.
 
 The firewall always allows access to a number of hosts that {% data variables.product.prodname_copilot_short %} uses to interact with {% data variables.product.github %}. By default, a recommended allowlist is also enabled to allow the agent to download dependencies.
@@ -56,11 +60,13 @@ For the complete list of hosts included in the recommended allowlist, see [AUTOT
 
 ## Configuring the firewall at the organization level
 
-Organization owners can configure all firewall settings at the organization level. To access the firewall settings:
+Organization owners can configure all firewall settings at the organization level, for both {% data variables.copilot.copilot_cloud_agent %} and {% data variables.copilot.copilot_code-review_short %}. To access the firewall settings:
 
 {% data reusables.profile.access_org %}
 {% data reusables.profile.org_settings %}
-{% data reusables.copilot.cloud-agent-settings %}
+{% data reusables.copilot.internet-access-settings %}
+
+The "Internet access" page has separate sections for {% data variables.copilot.copilot_cloud_agent %} and {% data variables.copilot.copilot_code-review_short %}, so you can configure the following settings independently for each.
 
 ### Enabling or disabling the firewall
 
@@ -88,13 +94,13 @@ Items added to the organization custom allowlist apply to all repositories in th
 
 ## Configuring the firewall at the repository level
 
-Repository administrators can configure firewall settings at the repository level, including enabling or disabling the firewall, enabling or disabling the recommended allowlist, and managing a custom allowlist. Depending on the organization-level configuration, some of these settings may be locked.
+Repository administrators can configure firewall settings at the repository level, including enabling or disabling the firewall, enabling or disabling the recommended allowlist, and managing a custom allowlist. Depending on the organization-level configuration, some of these settings may be locked. The repository settings page also has separate sections for {% data variables.copilot.copilot_cloud_agent %} and {% data variables.copilot.copilot_code-review_short %}, so you can configure these settings independently for each.
 
 To access the firewall settings:
 
 {% data reusables.repositories.navigate-to-repo %}
 {% data reusables.repositories.sidebar-settings %}
-1. In the "Code & automation" section of the sidebar, click **{% data variables.product.prodname_copilot_short %}** then **{% data variables.copilot.copilot_cloud_agent_short %}**.
+1. In the "Code & automation" section of the sidebar, click **{% data variables.product.prodname_copilot_short %}** then **Internet access**.
 
 ### Enabling or disabling the firewall
 

content/copilot/how-tos/copilot-on-github/customize-copilot/index.md

@@ -8,6 +8,7 @@ children:
   - /customize-copilot-overview
   - /add-custom-instructions
   - /customize-cloud-agent
+  - /customize-the-firewall
   - /configure-mcp-servers
   - /copilot-spaces
 contentType: how-tos

content/copilot/how-tos/use-copilot-agents/request-a-code-review/use-code-review.md

@@ -66,7 +66,7 @@ If you're happy with the changes, you can accept a single suggestion from {% dat
 You can also invoke {% data variables.copilot.copilot_cloud_agent %} to implement suggested changes. To do this, you must:
 
 * Enable {% data variables.copilot.copilot_code-review %} and {% data variables.copilot.copilot_cloud_agent %}.
-* On review comments from {% data variables.copilot.copilot_code-review %}, click **Fix with Copilot**. This creates a draft comment on the pull request, where you can instruct {% data variables.product.prodname_copilot_short %} to address specific feedback. You can then select whether {% data variables.product.prodname_copilot_short %} will create a new pull request against your branch or a commit to the same pull request with the suggestions applied.
+* On review comments from {% data variables.copilot.copilot_code-review %}, click **Fix with {% data variables.product.prodname_copilot_short %}**. This creates a draft comment on the pull request, where you can instruct {% data variables.product.prodname_copilot_short %} to address specific feedback. You can then select whether {% data variables.product.prodname_copilot_short %} will create a new pull request against your branch or a commit to the same pull request with the suggestions applied.
 
 ## Requesting a re-review from {% data variables.product.prodname_copilot_short %}
 
@@ -91,12 +91,23 @@ To automatically request re-reviews from {% data variables.product.prodname_copi
 To make these available for {% data variables.copilot.copilot_code-review_short %} on {% data variables.product.github %}, configure:
 
 * **Agent skills** in your repository (in `.github/skills`). If you want a skill to target review tasks, use a review-focused skill directory name such as `code-review`. For setup details, see [AUTOTITLE](/copilot/how-tos/copilot-on-github/customize-copilot/customize-cloud-agent/add-skills).
-* **MCP servers** in repository Copilot settings. The {% data variables.product.github %} MCP server and Playwright MCP server are enabled by default. For setup details, see [AUTOTITLE](/copilot/how-tos/copilot-on-github/customize-copilot/configure-mcp-servers).
+* **MCP servers** in repository {% data variables.product.prodname_copilot_short %} settings. The {% data variables.product.github %} MCP server and Playwright MCP server are enabled by default. For setup details, see [AUTOTITLE](/copilot/how-tos/copilot-on-github/customize-copilot/configure-mcp-servers).
 
 {% data reusables.copilot.code-review.mcp-context-usage %}
 
 {% data reusables.copilot.code-review.mcp-tools-setting %}
 
+## Customizing {% data variables.copilot.copilot_code-review_short %}'s environment
+
+{% data variables.copilot.copilot_code-review_short %} runs in an ephemeral development environment, similar to {% data variables.copilot.copilot_cloud_agent %}. You can customize this environment using a {% data variables.product.prodname_actions %} workflow file, in the same way you would for {% data variables.copilot.copilot_cloud_agent %}, for example, to preinstall tools or dependencies, or to switch to a different operating system. For more information on how to structure this file, see [AUTOTITLE](/copilot/how-tos/copilot-on-github/customize-copilot/customize-cloud-agent/customize-the-agent-environment).
+
+You can use either of the following files to configure {% data variables.copilot.copilot_code-review_short %}'s environment:
+
+* `.github/workflows/copilot-setup-steps.yml`: If you have already configured this file for {% data variables.copilot.copilot_cloud_agent %}, {% data variables.copilot.copilot_code-review_short %} will use the same configuration by default.
+* `.github/workflows/copilot-code-review.yml`: We recommend creating this file if you want to configure {% data variables.copilot.copilot_code-review_short %}'s environment independently of {% data variables.copilot.copilot_cloud_agent %}. If this file is present in your repository, it is used for {% data variables.copilot.copilot_code-review_short %} instead of `copilot-setup-steps.yml`.
+
+You can also configure firewall rules to control the domains and URLs that {% data variables.copilot.copilot_code-review_short %} can access, at both the organization and repository level. These settings are configured separately from {% data variables.copilot.copilot_cloud_agent %}'s firewall settings, in their own section of the same "Internet access" tab. See [AUTOTITLE](/copilot/how-tos/copilot-on-github/customize-copilot/customize-cloud-agent/customize-the-agent-firewall).
+
 ## Providing feedback on {% data variables.product.prodname_copilot_short %}'s reviews
 
 You can provide feedback on {% data variables.product.prodname_copilot_short %}'s comments directly within each comment. We use this information to improve the product and the quality of {% data variables.product.prodname_copilot_short %}'s suggestions.

data/reusables/copilot/internet-access-settings.md

@@ -0,0 +1 @@
+In the sidebar, under "Code, planning, and automation", click **{% octicon "copilot" aria-hidden="true" aria-label="copilot" %} {% data variables.product.prodname_copilot_short %}**, and then click **Internet access**.