Agentic autofix for code scanning alerts general availability
By Steven Van ·
Enterprise Cloud customers with Code Security or Advanced Security can assign up to 25 alerts to Copilot, which validates fixes with CodeQL.
Agentic autofix for code scanning alerts is now generally available to GitHub Code Security and GitHub Advanced Security customers on GitHub Enterprise Cloud, including GitHub Enterprise Cloud with data residency. Assigning an alert to Copilot starts an agent session that works through the fix and opens a draft pull request, as described in the GitHub documentation.
How the agent works
When an alert is assigned to Copilot, it takes these steps:
- Explores relevant files across the codebase, beyond the affected file.
- Generates a proposed fix.
- Reruns CodeQL to validate the fix.
- Iterates if needed, then opens a draft pull request for review.
The pull request includes a summary of the fix, why it closes the alert, and the validation steps Copilot took. Once it is ready, further changes can be requested by commenting on the pull request or by interacting with the session in the Agents tab of the repository.
Where to assign alerts
When enabled, agentic autofix replaces the free Generate Fix option on individual alerts with an Assign to Copilot button. It can be used in three ways:
- From any code scanning alert on the repository's default branch.
- From the list of security alerts in a repository or security campaign, by selecting up to 25 alerts to be fixed together in a single pull request.
- Through the Update a Code Scanning Alert REST API, by setting assignees to ["copilot-swe-agent[bot]"].
Alerts detected only on pull requests or other branches cannot be assigned to Copilot.
Access and billing
An enterprise administrator must first enable the new Agentic autofix policy in Advanced Security policies. After that, an organization or repository administrator can turn it on in the Code Security settings. A Copilot billing method must also be defined, though a Copilot license is not required. It is not available for repositories owned by Enterprise Managed Users.
Each agent session consumes AI Credits from the Code Security budget and GitHub Actions minutes. Credit usage appears in the AI usage section of enterprise billing.
Limits
Copilot validates fixes by rerunning CodeQL with the code scanning query suite. It cannot confirm fixes for alerts from custom CodeQL queries, the security-extended suite, or third-party tools. GitHub says to review and test the changes before merging.
Copilot Autofix, which suggests a single code change for one alert that the user applies, remains a separate feature. It does not consume AI credits.
