Make Copilot Review Configuration Observable From Pull Request to Finding

Primary source: https://github.blog/changelog/2026-07-17-copilot-code-review-customization-and-configurability-improvements/.

GitHub expanded Copilot code-review customization on July 17. Teams now need a cross-layer answer to a simple question: which configuration produced this finding?

type ReviewRun={
  pullRequest:string; baseSha:string; headSha:string;
  configDigest:string; startedAt:string;
  findings:{path:string,line:number,rule:string}[];
};

Render the digest in the UI, persist it with findings, and return it from the API. If configuration changes while a review runs, finish against the pinned digest or cancel and restart—never silently mix policies.

An end-to-end fixture should create a PR, start review, change configuration, and prove the original findings retain their provenance. Rollback disables customized review while preserving historical records.

This is an implementation pattern, not documentation of GitHub's internal schema. Which identifier would you need during an incident: config digest, base SHA, model, or all three?