Policy against using Copilot integrations on GitHub

[rossabaker]

Summoning Copilot for a review is now injecting ads into pull request descriptions:

• https://notes.zachmanson.com/copilot-edited-an-ad-into-my-pr/
• https://www.neowin.net/news/microsoft-copilot-is-now-injecting-ads-into-pull-requests-on-github-gitlab/

There is no apparent way to fully block Copilot from the organization. It is impossible for users to disable it once cursed with free Copilot Pro for Open Source users. But it should be against org policy to summon it here.

[jducoeur]

Yay, fun -- I can't say I'm surprised by this, but we definitely want it to be a no-no. We've already been talking about "you must write your own PR descriptions" as a rule, but it's probably worth calling this out as a specific example of the sort of thing that is off-limits.

[rossabaker]

I'm all for asking users to be accountable for their own langlemangling, but this is different: this is about users whose words are altered, without consent, by someone else's choice to invoke Copilot. Hard nope.

[djspiewak]

Yeah this is a little different. This would be where someone who has the write bit on the repo clicks the copilot button the PR.

IMO we should say "nope" on that for exactly this reason. In a sense this is about contributor safety: they should know that maintainers will treat their work with respect. You want to use agentic coding? Do it locally and push the results.

[valencik]

Yikes.

So what do we actually do here?

1. Adopt and announce this policy
2. Look out for any "Edited by Copilot AI" PRs

Perhaps recommend / point out to users that at least some Copilot settings can be disabled in your Privacy settings:

[rossabaker]

Settings are challenging to suggest because they vary by tier. I don't have the Visibility option: mine is forced on, everywhere. And the organization settings are insufficient to enforce policy. It's going to have to be a social norm, with corrections more explanatory than punitive. The harms are not entirely apparent on first click.