GitHub releases agentic autofix for code scanning alerts

What happened

GitHub announced general availability of agentic autofix for code scanning alerts. The feature uses Copilot to autonomously remediate security vulnerabilities detected by GitHub's code scanning tool. When enabled, it replaces the free Generate Fix option with an Assign to Copilot button on individual alerts.

How it works

When you assign a code scanning alert to Copilot, the agent explores relevant files across your codebase, generates a proposed fix, and validates it by rerunning CodeQL to confirm the alert closes. If needed, it iterates on the fix. Once satisfied, it opens a draft pull request ready for your review. The pull request includes a summary of the remediation, an explanation of how it closes the alert, and documentation of the validation steps Copilot performed.

After opening the pull request, you can request further changes by commenting on it or interacting with the session in the Agents tab of your repository.

How to use it

Agentic autofix supports code scanning alerts on your repository's default branch only; alerts detected only on pull requests or other branches cannot be assigned to Copilot.

You can trigger autofix in three ways. From any code scanning alert in the repository, click the Assign to Copilot button. In the security alerts list or security campaign view, select up to 25 alerts for Copilot to fix together in a single pull request. Via the REST API, set the assignees field to ["copilot-swe-agent[bot]"] when updating a code scanning alert.

• From individual alerts on the default branch
• From the security alerts list or campaign view (up to 25 at once)
• Via the Update a Code Scanning Alert REST API

Requirements and access

Agentic autofix is available to customers with GitHub Code Security and GitHub Advanced Security on GitHub Enterprise Cloud, including deployments with data residency.

Access requires two steps. First, an enterprise administrator must enable the new Agentic autofix policy in Advanced Security policies. Second, an organization or repository administrator can turn on agentic autofix in the Code Security settings for their organization or repository. Additionally, a Copilot billing method must be defined on the account.

Billing and costs

Agentic autofix consumes AI Credits from your Code Security budget and GitHub Actions minutes. AI Credit usage appears in the AI usage section of enterprise billing and licensing under the Advanced Security product. Enterprise administrators can set SKU-level budgets specifically for Code Security AI credits.

Source

AI-assisted, verified against the source. This post was drafted with AI from the primary source linked above and checked automatically against it. For anything you depend on, read the original.