GitHub used its Universe conference in San Francisco on 28 October to change how most companies will pay for Copilot. Enterprise customers can now use every Copilot feature, including the new Copilot app, code review and automations, as part of GitHub Enterprise, without buying a separate Copilot subscription. They pay for the AI credits they use instead.
For DevOps and platform teams, the bigger story sits underneath the pricing. Copilot is no longer only an assistant in an editor. It now runs scheduled and event-driven jobs inside your repositories, reviews pull requests at three depths, and scans whole codebases for vulnerabilities. That makes it something you have to budget, permission and govern like any other part of the delivery pipeline.
What did GitHub announce at Universe 2026?
According to the GitHub keynote post, the main announcements were:
Copilot included with GitHub Enterprise. All Copilot features with no separate subscription, paid for through AI credits. It is available through GitHub sales now, with self-serve "coming soon". Existing Copilot Business and Enterprise customers can stay on their current plans or move later.
Copilot automations. AI workflows that run in the cloud inside a repository, triggered by hand, by an event or on a schedule. GitHub gives issue triage and code review as examples. Automations can also suggest changes to themselves based on past results, which a person then approves.
Copilot code review Max. A deeper review tier aimed at high-severity issues, sitting alongside the existing Lite and Balanced tiers for everyday reviews.
Copilot Fusion. A routing layer that picks a model for each part of a task. I Programmer reports it as generally available. GitHub says its top setting scored within two points of the strongest model it compared against on a public coding agent benchmark, at half the cost and in 40% less time per task.
Copilot projects. Agent work that spans several repositories, run as parallel sessions with one place to track progress, available in the Copilot app from 28 October.
GitHub also said it has added 4 million CPU cores, 160 PB of fast storage and 50 Tb/s of network capacity this year, and expects to finish moving its platform onto multiple Azure regions early in 2027. There were no announcements for GitHub Actions itself.
Which security features matter for pipelines?
Two security previews landed around the conference and are worth more attention than the keynote gave them.
AI Scan for repositories, in public preview since 28 October, scans the latest commit on your default branch rather than only the changes in a pull request. It targets languages and frameworks that CodeQL does not cover, skips anything CodeQL already reports, and puts its findings in the same code scanning alert list. It does not need a Copilot licence, but private repositories need GitHub Code Security or Advanced Security, and every scan uses Code Security AI credits.
The GitHub package firewall, in public preview since 20 October, checks npm package requests against policies an admin sets before anything is installed. Controls include a cooldown period for new versions, checks against the GitHub Advisory Database for malware and vulnerabilities, and attestation downgrade checks. It is npm only, limited to GitHub Enterprise Cloud, free during preview and billed by usage at general availability, in the same way as Actions.
After a month of poisoned package releases across ecosystems, a cooldown period on new npm versions is the simplest control in this list to justify.
What does the move to AI credits mean for your budget?
Seat-based licences are easy to forecast. Credit-based billing is not. Under the new model, the cost of Copilot depends on how many automations you run, which review tier you pick and how heavily developers use agents. Code review Max and whole-repository AI scans are exactly the kind of features that are cheap to switch on and expensive to leave running everywhere.
GitHub has not published per-credit prices in its announcement. Until you have those numbers from your account team, treat any switch from seats to credits as a cost experiment, not a saving.
What should DevOps teams do this month?
Get the credit prices in writing. Compare them with your current Copilot seat costs before agreeing to move plans. Existing customers do not have to move now.
Set budgets before you switch features on. Code Security AI credits can be budgeted at SKU level. Do that first, then enable AI Scan on a small set of repositories.
Treat automations like workflow files. Decide who can create them, what they can change, and require a human review before an automation's self-suggested changes are accepted.
Pick review tiers per repository. Keep Max for repositories that handle payments, authentication or infrastructure code, and leave the rest on Lite or Balanced.
Trial the package firewall with a cooldown. If you are on Enterprise Cloud, start with one organisation and a short cooldown on new npm versions, then watch how often builds are blocked.
The pricing change will get the headlines. The more lasting change is that a growing share of what happens in your repositories will be started by an agent, and someone on the platform team needs to own how that is paid for and controlled.
Quick answers
Is Copilot now included with GitHub Enterprise?
Yes. GitHub announced on 28 October 2026 that Enterprise customers can use all Copilot features without a separate subscription and pay for the AI credits they use. It is available through GitHub sales, with self-serve coming later, and existing Copilot plans can stay as they are.
Is the GitHub package firewall generally available?
No. It entered public preview on 20 October 2026 for GitHub Enterprise Cloud, covers npm only, and is free during the preview. GitHub says it will be billed by usage at general availability.
Did GitHub announce changes to GitHub Actions at Universe 2026?
No Actions changes were included in GitHub's Universe 2026 announcement post. The pipeline-related news was Copilot automations, AI Scan for repositories and the npm package firewall.
