THE COLLECTION
EVERY SIGNAL, SORTED.
Search the whole shelf by topic, tool, term, or plain old curiosity.
United States, Application Security, Pull Requests, Code Scanning, AI Agents, Software Supply Chains, Developer Workflows and Human Review
GitHub put AI security findings in the pull request. Advisory is not a gate
GitHub can now flag vulnerabilities in pull-request code that CodeQL does not cover, and an agent can investigate older alerts and draft repairs. One system warns. The other proposes. Neither should quietly become permission to merge.
AI Code Review, Software Quality, Open Benchmarks, Evaluation Design, Developer Tools and Human Oversight
GitHub built a code-review benchmark that measures useful findings, not comment confetti
ReviewBench asks whether an AI reviewer finds real problems without burying developers in noise. Its public dataset is unusually inspectable, but a benchmark that anyone can study is also a benchmark agents can study for.
AI Code Review, Trust and Developer Workflows
GitHub's AI reviewer now closes its own comments
Copilot can reread a changed pull request and mark its earlier objection resolved. That cleans up the queue, but a quiet thread is not the same thing as correct code.
Builder Governance
The robot reviewer can now sign the merge slip
GitHub can let Copilot submit a formal pull-request approval that counts toward a repository rule, moving AI judgment from advice into governance.