Copilot Preview: Tracing Suggestions Back to Public Repositories
In June, GitHub introduced a filter that blocks Copilot suggestions of 150+ characters when they match public code (ignoring whitespace). That feature addresses a narrow set of cases, but blocking a match doesn't tell a developer anything about where the code came from or whether it's safe to use.
GitHub plans to close that gap in 2023 with new capabilities that give developers more context for any suggested code fragment:
- A list of similar code found in public GitHub repositories
- Sorting controls for that list by repository license, commit date, and other metadata
A common JavaScript snippet illustrates the point. Many JS developers will instantly recognize this expression:
const root = ReactDOM.createRoot(document.getElementById('root'))
The fragment appears verbatim in thousands of JavaScript files—not because it's the only way to write the logic, but because it's the conventional implementation. It also shows up in repositories under many different licenses. Unless a developer already knows the code's provenance, they might not realize it originated in the React repository.
In Copilot's next major release, GitHub will let developers identify strings that match public code and view references to the repositories where they appear.
That reference context lets a developer explore other codebases for inspiration, find documentation, and—importantly—gain confidence that a fragment fits their project. The repository info can inform whether to take a dependency, add attribution where appropriate, or seek an entirely different implementation approach. By surfacing the community context of suggested code without disrupting developer flow, GitHub expects Copilot to deliver both responsible innovation and a better experience at the keyboard.
