🗝️ Main Branch: The One Where Permissions Get Picky

Hiya friends,

Back from Berlin with a new repo in hand, more on that in a bit. On the product side, GitHub closed two permission gaps: who can dismiss a pull request review, and what your CI can run without a personal access token.

🚢 What Shipped

Rulesets now control who can dismiss reviews

A required review is only as strong as its dismiss button. Until now, anyone with write access could dismiss a blocking review and clear the way to merge. The new control lives inside the Require a pull request before merging rule: pick the users, teams, or apps allowed to dismiss, and the button disappears for everyone else. You can configure it in the UI, the REST API, or GraphQL, and it is GA for repository rulesets on github.com. If required reviews gate your default branch, go name your dismissers.

Copilot CLI drops the PAT requirement in Actions

Running Copilot CLI inside a workflow used to mean minting a personal access token, storing it as a secret, and remembering to rotate it. Now the CLI authenticates with the workflow’s built-in GITHUB_TOKEN. Your job needs one permission and zero new secrets:

permissions:
 copilot-requests: write

In organization-owned repos, AI credits bill directly to the org. One setup note: the Allow use of Copilot CLI billed to the organization policy must be enabled. It defaults to on if you already allow Copilot CLI.

📺 What I’m Watching

Life Is Beautiful (La Vita è Bella) by Roberto Benigni

I love historical war books and films. This one sits in my top 3 for WW2: I watched it very young, and rewatching it as a parent broke my heart in all new ways.

Worth your time if: you want to watch one of the best films ever made.

🔧 What I’m Using

Ponytail. A skill for your coding agent, modeled on the senior dev who replaces fifty lines with one. I ran a real test recently: same task, with and without it active. Without it I built two classes, five functions, number formatting, and 89 lines. With it I stopped at stdlib. No classes, no formatters, 20 lines. That’s 77% fewer lines and zero classes, and both versions work the same.

✨ This Week

Berlin is one of my favorite cities in the world. The history you can feel on every block, the people, the sauna culture, the baked goods that ruin you for other baked goods. This trip added a new reason at the booth: while I was demoing the GitHub Copilot app at WeAreDevelopers, a conversation drifted to GIFs and turned into APNG Studio, a canvas we built right there at the event. That’s what happens when you’re in a room full of people ready to build, not just attend. Drop in your frames, get a clean animated PNG for your READMEs, slides, or side projects.

I’ll be at Nebraska Code next week. Say hi if you’re there, and if you’re a Main Branch subscriber, I have a present for you.

That’s it for today!

With gratitude,

Andrea

PS: WeAreDevelopers brings the conf to San Jose this September, with AAIF VP Angie Jones, Netlify CEO Mathias Biilmann, and my friend Francesco Ciulla on the lineup; if you want to be there, please reply to this and let me know.

Don’t say the name out loud…but they were that f..in good 😁