What changed
GitHub added issue-comment and pull-request-comment triggers to Copilot cloud agent Automations and let users choose a supported model's reasoning level for each delegated task. Comment text can start documentation, investigation or follow-up work, while reasoning level changes token and credit use.
Why it matters
Repository comments can now initiate agent work, and operators can trade cost and latency for more reasoning at task start. Trigger provenance, commenter authority, duplicate events, branch permissions and the selected model configuration therefore belong in the automation audit trail.
What to do
Create a disposable repository automation for one exact comment phrase, restrict its token and repository scope, and run authorized, unauthorized and duplicated comments. Capture actor, event ID, model, reasoning level, credits, changed files, approvals and terminal state before enabling repository writes.
Caveat
GitHub documents product availability, not independent task quality or abuse resistance. Paid-plan and administrator policy requirements apply; higher reasoning can consume more credits, and comment-triggered work can still repeat, act on hostile text or exceed intended repository scope without external controls.