Skip to main content

Responsible use of GitHub Copilot code completion

Learn how to use Copilot code completion responsibly by understanding its purposes, capabilities, and limitations.

About GitHub Copilot code completion

Copilot code completions are autocomplete-style suggestions generated inline by GitHub Copilot. Copilot code completion creates the experience of working with an AI-powered pair programmer, automatically offering suggestions to complete your code. In addition, it can suggest code comments, tests, and more. It provides these suggestions directly in supported editors while you write your code, and it can work with a broad range of programming languages and frameworks. For more information, see Was ist GitHub Copilot?.

Copilot's suggestions may be the completion of the current line, but will sometimes be a whole new block of code. You can accept all or part of a suggestion, dismiss the suggestion, or keep typing and ignore the suggestions.

Copilot code completion works by using a combination of natural language processing and machine learning to understand your surrounding code (relative to your cursor position) and provide you with suggestions. This process can be broken down into a number of steps.

Input processing

The surrounding code from the user’s cursor is pre-processed by the Copilot code completion system, combined with contextual information (such as code snippets from open tabs in the editor) and sent to a large language model in the form of a prompt. For information about data retention, see the GitHub Copilot Trust Center.

The large language model then takes the prompt and provides a response based on the prompt. The system is only intended to assist with coding.

Language model analysis

The large language model that processes the input prompt is a fine-tuned code completion language model, which is a neural network that has been trained on a large body of code data specialized for inline code completion.

You can change the model that is used for code completion. See Ändern des KI-Modells für die Copilot-Codevervollständigung.

Response generation

The language model generates a response based on its analysis of the input prompt and the context provided to it. This response takes the form of generated code and plain text comments, ranging from the completion of the current line to a whole new block of code.

Output formatting

The response generated by Copilot is formatted as “ghost text” that is visually distinct from the surrounding code and presented to the user as a suggestion. It is only added to the file/codebase if the user explicitly accepts the suggestion. Users can accept all or part of a suggestion, dismiss the suggestion, or they can keep typing and ignore the suggestions in which case the suggestion is discarded.

GitHub Copilot code completion is intended to provide you with the most relevant and useful code suggestions to augment your existing code. However, it may not always provide the answers that you are looking for. Users of Copilot are responsible for reviewing and validating responses generated by the system before they accept them, to ensure they are accurate and appropriate. Additionally, as part of our product development process, we undertake red teaming to understand and improve the safety of Copilot code completion. The generated code completions are also run through content filters. The content filtering system detects and blocks Copilot from outputting any harmful or offensive content, or insecure code. Furthermore, depending on the user’s GitHub settings, the filter also blocks or annotates suggestions that contain matches to public code.

Use cases for GitHub Copilot code completion

GitHub Copilot code completion can provide coding assistance in a variety of scenarios.

Generate code based on your instructions

In addition to relying on Copilot to provide suggestions, you can use code comments to tell Copilot about the code you expect to follow the comment. For example, you could use comments such as "use recursion" or "use a singleton pattern" to specify a type of algorithm Copilot should suggest. Or you could use comments to tell Copilot which methods and properties to add to a class.

Generating unit test cases

Copilot code completion can help you write unit test cases by generating code snippets based on the surrounding code typed in the editor. This may help you spend less time on repetitive tasks writing test cases. For example, if you are writing a test case for a specific function, you can use Copilot to suggest possible input parameters and expected output values based on the function's signature and body. Code completion can also suggest assertions that ensure the function is working correctly, based on the code's context and semantics.

Copilot code completion can also help generate test cases for edge cases and boundary conditions that might be difficult to identify manually. For instance, Copilot can suggest test cases for error handling, null values, or unexpected input types, helping you ensure your code is robust and resilient. However, it is important to note that generated test cases may not cover all possible scenarios, and manual testing and code review are still necessary to ensure the quality of the code.

This can be a useful tool for programmers, as it can provide guidance and support for common coding tasks and challenges.

Improving performance for GitHub Copilot code completion

Copilot code completion can generate code suggestions in a number of different contexts, with different performance and quality metrics. To enhance performance and address some of the limitations of Copilot code completion, there are various measures that you can adopt. For more information on the limitations of Copilot code completion, see Limitations of GitHub Copilot code completion.

Keep your prompts on topic

Copilot is exclusively intended to generate completions that are either code-related or code itself. Therefore, limiting the context of the content in the editor to code, or coding-related information, can enhance the model's output quality.

Use Copilot code completion as a tool, not a replacement

While Copilot can be a powerful tool for generating code, it is important to use it as a tool rather than as a replacement for human programming. You should always review the code generated by Copilot before accepting a suggestion, and further validate it after to ensure that it meets your requirements and is free of errors or security concerns.

Wichtig

Users assume all risks associated with generated code including security vulnerabilities, bugs, and IP infringement.

Use secure coding and code review practices

While Copilot code completion can generate syntactically correct code, it may not always be secure. You should always follow best practices for secure coding, such as avoiding hard-coded passwords or SQL injection vulnerabilities, as well as following code review best practices, to address Copilot’s limitations.

Stay up to date

Copilot code completion is still a fairly new technology and is likely to evolve over time. You should stay up to date with any updates or changes to the tool, as well as any new security risks or best practices that may emerge. Automated extension updates are enabled by default in Visual Studio Code, Visual Studio, and the JetBrains suite of IDEs. If you have automatic updates enabled, Copilot will automatically update to the latest version when you open your IDE. For more information on automatic updates in your IDE, see the documentation for your preferred IDE or code editor.

Limitations of GitHub Copilot code completion

Depending on factors such as your codebase and input data, you may experience different levels of performance when interacting with Copilot code completion. The following information is designed to help you understand system limitations and key concepts about performance as they apply to Copilot code completion.

Limited scope

Copilot code completion is trained on a large body of code but still has a limited scope and may not be able to handle more complex code structures or obscure programming languages. For each language, the quality of suggestions you receive may depend on the volume and diversity of training data for that language. For example, JavaScript is well-represented in public repositories and is one of GitHub Copilot's best supported languages. Languages with less representation in public repositories may be more challenging for Copilot to assist. Additionally, Copilot code completion can only suggest code based on the context of the code being written, so it may not be able to identify larger design or architectural issues.

Lastly, Copilot code completion is intended to generate code and code-related output. Using Copilot code completion is not intended to generate natural language outputs.

Potential biases

Copilot's training data is drawn from existing code repositories, which may contain biases and errors that can be perpetuated by the tool. Additionally, Copilot code completion may be biased towards certain programming languages or coding styles, which can lead to suboptimal or incomplete code suggestions.

Security risks

Copilot generates code based on the context of the code being written, which can potentially expose sensitive information or vulnerabilities if not used carefully. You should be careful when using Copilot to generate code for security-sensitive applications and always review and test the generated code thoroughly.

Matches with public code

Copilot code completion is capable of generating new code, which it does in a probabilistic way. While the probability is low, Copilot may generate code suggestions that match code in the training set.

Inaccurate code

One of the limitations of Copilot is that it may generate code that appears to be valid but may not actually be semantically or syntactically correct or may not accurately reflect the intent of the developer. To mitigate the risk of inaccurate code, you should carefully review and test the generated code, particularly when dealing with critical or sensitive applications. You should also ensure that the generated code adheres to best practices and design patterns and fits within the overall architecture and style of the codebase.

Users need to evaluate potential specific legal and regulatory obligations when using any AI services and solutions, which may not be appropriate for use in every industry or scenario. Additionally, AI services or solutions are not designed for and may not be used in ways prohibited in applicable terms of service and relevant codes of conduct.

Next steps

For details of how to use Copilot code completion, see:

Further reading