Back to rankings

GitHub Copilot: Agentic Autofix for Code Scanning Alerts Is Now Generally Available

GitHub CopilotView original changelog

GitHub made agentic autofix for code scanning alerts generally available. Users can assign an alert to Copilot, which explores the codebase, writes a fix, reruns CodeQL to validate it, and opens a draft pull request with its reasoning. Up to 25 alerts can be fixed in one pull request, and the feature is available to GitHub Code Security and Advanced Security customers on GitHub Enterprise Cloud.

Key Takeaways

  • Agentic autofix is now generally available, replacing the free "Generate Fix" option with an Assign to Copilot button.
  • Copilot explores the codebase, writes a fix, reruns CodeQL and iterates before it opens a draft pull request.
  • The draft pull request includes the summary, reasoning and validation steps, so reviewers can see how the fix was checked.
  • Users can select up to 25 alerts to fix in one pull request, or assign alerts through the REST API with copilot-swe-agent[bot].
  • Only alerts on the default branch can be assigned; alerts found only on pull requests or other branches cannot.
  • It needs the Agentic autofix policy enabled by an enterprise admin and bills AI Credits plus Actions minutes against the Code Security budget.

From Suggested Fix to Agent-Driven Pull Request

GitHub has taken agentic autofix for code scanning alerts to general availability. The feature replaces the free "Generate Fix" option with an "Assign to Copilot" button. Instead of producing a single suggested patch, Copilot works as an agent on the alert.

When an alert is assigned, Copilot explores the relevant files across the codebase and generates a proposed fix. It then reruns CodeQL to confirm that the fix resolves the alert, and iterates if the check fails. When it is satisfied, it opens a draft pull request that includes a summary of the change, the reasoning behind it, and the validation steps it took. Reviewers can ask for further changes by commenting on the pull request or by using the Agents tab.

Assigning Alerts

Any alert on the default branch can be assigned to Copilot. Users can also select up to 25 alerts and have them fixed in a single pull request, which helps when a backlog of similar findings can be cleared together. The REST API is supported as well: setting assignees to copilot-swe-agent[bot] assigns the alert to Copilot. Alerts found only on pull requests or non-default branches cannot be assigned.

Availability, Setup and Billing

Agentic autofix is available to GitHub Code Security and GitHub Advanced Security customers on GitHub Enterprise Cloud, including data residency. An enterprise administrator first enables the Agentic autofix policy in Advanced Security policies. An organization or repository administrator can then turn it on in Code Security settings. A Copilot billing method must be defined.

Usage consumes AI Credits from the Code Security budget, plus GitHub Actions minutes. The AI Credit usage appears under the "Advanced Security" product in the AI usage section of enterprise billing, and SKU-level budgets are available.