GitHub Copilot cheat sheet

Copilot suggestions are probabilistic completions, not authoritative answers: verify generated code, API signatures, and license-bearing snippets before merging.

Copilot does not know your private repositories unless they are provided as context; it cannot infer internal conventions that are not in the prompt or open files.

Accepted suggestions become your code: responsibility for correctness, security, and licensing rests with the developer who commits it, not with the tool.

Copilot may emit deprecated APIs or plausible-but-nonexistent methods; treat compiler errors and failing tests as the primary signal that a suggestion is wrong.

Duplicate-detection and public-code matching filters reduce, but do not eliminate, the chance of reproducing known public code; the duplication detection filter can be toggled by organization policy.

Responsible use requires reviewing suggestions for security-sensitive paths (auth, crypto, SQL, deserialization) at least as carefully as hand-written code.

Disclosing AI assistance follows the policy of the receiving project or employer; some open-source projects restrict or require attribution for AI-generated contributions.

Prompt and context content leaves the client for processing; never paste secrets, credentials, or regulated personal data into chat or inline prompts.

Inline completion accepts with Tab, rejects with Esc, and cycles alternative suggestions with Alt+] (Option+] on macOS) or the editor's next-suggestion command.

Copilot Chat answers questions about the current file, selection, or workspace depending on the context references attached to the prompt (@workspace, @vscode, @terminal, #file, #selection).

Slash commands in chat are shortcuts: /explain, /fix, /tests, /doc, /new, /newNotebook, /help, and /clear each map to a predefined prompt intent.

Copilot Edits (agent/edit mode) applies multi-file changes as a reviewable diff set; you accept or discard each file's changes rather than single-line completions.

Copilot code review can be requested on a pull request and posts comments as a reviewer; findings are suggestions and do not block merge by themselves.

Copilot CLI and the terminal chat surface let you ask for shell commands and explanations; generated commands must be reviewed before execution.

Copilot in GitHub.com (chat on the website) can summarize issues and pull requests and propose changes in a branch; it is separate from IDE inline completion.

Copilot for pull request summaries generates a description from the diff; the author remains responsible for the accuracy of the summary.

Copilot Spaces and knowledge bases let you curate reference files and instructions that are attached to chats, changing what context the model sees.

Copilot is a client-server system: the IDE extension collects context (open files, cursor neighborhood, selections) and sends prompts to a hosted model service; completions stream back to the editor.

Context assembly is bounded: the client selects and truncates surrounding code and prompt text to fit a token budget, so distant files rarely influence inline completions.

Completion models and chat models are distinct deployments; inline suggestions favor low latency, while chat requests can use larger models with longer context.

Prompts and suggestions are transmitted to GitHub's service and to the underlying model provider; retention and training use are governed by the plan and by organization settings.

Code referencing matches suggestions against a public code index and can surface repository and license matches for accepted code.

Copilot does not train models on your code by default for Business and Enterprise; individual plans expose a setting controlling whether snippets may be used for product improvement.

Content exclusions are enforced server-side for the repositories and paths they cover, so excluded files are not used to generate suggestions.

Copilot metrics and audit logs record usage events (acceptances, seats, feature usage) for administrators; they do not expose full prompt text to org owners.

Proxy and firewall configuration must allow the Copilot endpoints; the editor extension uses HTTPS to GitHub hosts and the model service.

Specificity rule: state language, framework, version, input/output shape, and constraints in the prompt; ambiguity in the request becomes variance in the completion.

Open the relevant files and select the target region before prompting; the selection and neighboring code are the strongest context signals for inline suggestions.

Few-shot pattern: include one or two short examples of the desired style or signature in the prompt to anchor format.

Decompose large tasks into small prompts (signature first, then body, then tests) because each completion is bounded by the context window and by latency.

Use comment-driven development: write a precise docstring or comment describing behavior, then trigger completion; the comment becomes the specification.

Negative constraints work: state what not to do (no new dependencies, no network calls, keep the public API unchanged) to narrow the output space.

Attach references explicitly with #file, #selection, or @workspace rather than assuming the model has seen them; unstated context is absent context.

Iterate by refining, not re-rolling: edit the prompt or add the missing context instead of repeatedly regenerating the same request.

For chat, ask for a plan or diff before code so errors in reasoning are caught before they propagate into files.

High-yield tasks: boilerplate scaffolding, test generation from existing functions, docstrings, regex construction, and translating code between languages.

Use /tests to generate unit tests from a selection, then review assertions for correctness; generated tests often encode the implementation's bugs.

Use /explain and /fix on unfamiliar code and stack traces; paste the full error and relevant frames for better diagnoses.

Copilot Chat can generate commit messages and pull request descriptions from staged diffs, reducing context-switching.

Copilot Edits suits repetitive refactors across files (rename, signature change, pattern replacement) where the diff is reviewable.

Keep changes small and verify with the build and test suite after each accepted batch; large unreviewed acceptances increase rework.

Copilot in the CLI speeds up command recall (git, package managers, cloud CLIs) but every generated command needs inspection before execution.

Measure impact with Copilot metrics (acceptance rate, active users, feature adoption) rather than anecdote; acceptance rate alone does not prove quality gains.

Copilot complements, and does not replace, static analysis, code review, and tests as quality gates.

Content exclusion is configured at the organization or enterprise level by repository or path; excluded files are not used as prompt context and are not sent for completion.

Exclusion rules use repository and path patterns (for example, a repository name plus a path glob); the most specific matching rule applies and rules can be inherited from the enterprise.

Exclusions apply to Copilot features that send context, including chat and code completion; they are not a substitute for repository access control.

Suggestion matching to public code can be blocked by policy: the organization can disallow suggestions matching public code, so matching completions are suppressed.

Duplication detection filter blocks suggestions that match public code even when public-code matching is allowed; the two controls are distinct.

Audit log events record changes to Copilot policies (content exclusion, seat assignment, feature toggles) for enterprise owners.

Seat management: organizations assign Copilot seats to users or teams; unassigned users receive no suggestions, and seat changes appear in audit logs.

Policy hierarchy: enterprise-level settings constrain what organizations can enable; organization settings then apply to members, and user settings apply within that envelope.

Individual privacy settings control whether code snippets may be retained and used for model training; Business and Enterprise plans do not use member code for training.