Add opt-in Copilot AL code review

[Wael (WaelAbuSeada)]

❔What, Why & How

Adds an opt-in enableCopilotCodeReview repository setting that distributes a secure two-workflow integration with the public microsoft/BC-ALAgents AL reviewer.

When enabled through Update AL-Go System Files, AL-Go adds a read-only pull request intake workflow and a trusted workflow_run runner. The runner revalidates the current PR state, configured base branch, author, draft status, and head SHA before calling review.yml@latest. Fork pull requests are resolved by head owner and branch and must match exactly one open PR at the completed workflow SHA.

When disabled (the default), Update AL-Go System Files removes both reviewer workflows. Documentation covers organization policy, permissions, activation, architecture, and removal.

Related to issue: N/A

✅ Checklist

• Add tests (E2E, unit tests)
• Update RELEASENOTES.md
• Update documentation (e.g. for new settings or scenarios)
• Add telemetry — not applicable; the integration delegates review execution to BC-ALAgents and adds no AL-Go runtime action.

[Copilot]

Pull request overview

Adds opt-in AL pull-request reviews through trusted intake and runner workflows backed by BC-ALAgents.

Changes:

• Adds and documents enableCopilotCodeReview.
• Adds reviewer workflows with eligibility validation.
• Updates system-file generation and test coverage.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
Tests/WorkflowSanitation/WorkflowReferences.Test.ps1	Updates workflow-reference test descriptions.
Tests/WorkflowSanitation/WorkflowFileContent.Test.ps1	Tests reviewer workflow security properties.
Tests/TestActionsHelper.psm1	Allows the BC-ALAgents reusable workflow.
Tests/ReadSettings.Test.ps1	Tests the disabled default.
Tests/CheckForUpdates.Action.Test.ps1	Tests workflow inclusion, removal, and branches.
Templates/Per Tenant Extension/.github/workflows/CopilotPRReviewRunner.yaml	Adds the trusted PTE review runner.
Templates/Per Tenant Extension/.github/workflows/CopilotPRReview.yaml	Adds the PTE intake workflow.
Templates/AppSource App/.github/workflows/CopilotPRReviewRunner.yaml	Adds the trusted AppSource runner.
Templates/AppSource App/.github/workflows/CopilotPRReview.yaml	Adds the AppSource intake workflow.
Scenarios/settings.md	Documents the new setting.
Scenarios/CopilotCodeReview.md	Adds setup and architecture guidance.
RELEASENOTES.md	Announces the integration.
README.md	Links the new scenario.
Actions/CheckForUpdates/CheckForUpdates.HelperFunctions.ps1	Generates or removes reviewer workflows.
Actions/.Modules/settings.schema.json	Defines the setting schema.
Actions/.Modules/ReadSettings.psm1	Adds the default setting value.

Suppressed comments (2)

Templates/Per Tenant Extension/.github/workflows/CopilotPRReviewRunner.yaml:108

• This mutable latest ref allows upstream changes to execute with the caller's pull-request/issues write and Copilot billing permissions without an AL-Go system-file update or review. The called workflow's engine_ref contract also says to pin it to match the uses: SHA, whereas line 114 passes another mutable lookup. Pin both references to the same immutable commit and advance that pin through AL-Go updates.

    uses: microsoft/BC-ALAgents/.github/workflows/review.yml@latest

Templates/AppSource App/.github/workflows/CopilotPRReviewRunner.yaml:108

• This mutable latest ref allows upstream changes to execute with the caller's pull-request/issues write and Copilot billing permissions without an AL-Go system-file update or review. The called workflow's engine_ref contract also says to pin it to match the uses: SHA, whereas line 114 passes another mutable lookup. Pin both references to the same immutable commit and advance that pin through AL-Go updates.

    uses: microsoft/BC-ALAgents/.github/workflows/review.yml@latest

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Jose M. Martinez (jmanuelmartinez)]

Hey there! 😀

I'd find interesting to pin both the reusable workflow and engine_ref to the same immutable BC-ALAgents commit?

The latest tag is mutable, so upstream changes could execute with this caller's pull-requests: write, issues: write, and copilot-requests: write permissions without an AL-Go update or review.

The BC-ALAgents workflow contract also recommends keeping these two refs pinned and aligned - https://github.com/microsoft/BC-ALAgents/blob/main/README.md

The same change should be made in the AppSource template.