Copilot code review only ever files comments, so stop buying it as a merge gate

The asymmetry here has nothing to do with model quality. Spotting a possible defect is probabilistic work; stopping a merge needs an explicit policy, a visible status, a controlled override, and an audit trail ^[3]. A comment carries none of those properties, so GitHub's boundary reads as a coherent design decision rather than a gap to route around ^[1].

Map the four products in the source onto the four checkpoints and almost nothing overlaps. CodeBuddy is described as useful before a pull request exists, in IDE, extension and CLI workflows, with Chinese-language requirements and comments ^[15]. Cody addresses the context bottleneck at investigation time, using keyword search, Sourcegraph Search and the code graph to find the dangerous caller that lives in another repository ^[10]. Copilot spans local review in VS Code, Visual Studio, JetBrains IDEs and Xcode plus PR review on GitHub ^[6], with instruction files and path rules for customization ^[7]. CodeRabbit runs triage across GitHub, GitLab, Azure DevOps and Bitbucket with path filters and path-specific instructions ^[5], and reaches the fourth checkpoint only because its pre-merge check becomes a deterministic status inside branch protection with a human override attached ^[4]. That is a portfolio with one contested column, not a bake-off ^[13].

Two Copilot operational details deserve more weight than they usually get. If the Actions runners behind the agentic capabilities are unavailable, a review is still generated, minus the context-gathering ^[8]. And by default, review may only happen when the PR opens, so re-review on new pushes is something you verify rather than assume ^[9]. Enabling the feature therefore buys coverage that is neither guaranteed complete nor guaranteed repeated ^[14], and the artefact on the PR looks the same in the degraded case as in the good one. To borrow the author's analogy, a triage nurse can decide you are in real trouble, move you up the queue and hand the doctor a useful summary, but cannot authorize surgery ^[16]. The author's charge is that most teams shopping AI code review are buying the nurse while writing the job description for the surgeon ^[17].

Read the source with its provenance in view. It is a dev.to comparison whose sharpest structural contrast lands in CodeRabbit's favour, since CodeRabbit is the one product credited with a status that participates in branch protection ^[4]. Its CodeBuddy conclusion is stated as an evidence limit inside the official material reviewed, not as a finding that the capability is absent ^[15]. The load-bearing part is the piece nobody has to take on trust: GitHub documents that Copilot's review never counts toward required approvals and never blocks a merge ^[1].

Which leaves the fourth checkpoint exactly where it was. Merge governance is staffed by branch rules demanding tests, static analysis, security scans, designated human approvals and auditable exceptions ^[12]. AI output can be evidence inside that machinery, and in CodeRabbit's case a status feeding it ^[4], but the enforcement stays mechanical. If a procurement conversation promises otherwise, the thing being sold is checkpoint three with a checkpoint four label on the box.