Skip to content

GitHub agentic autofix for code scanning alerts reaches GA

Copilot can now explore a repository, patch a CodeQL alert, verify the fix, and open a draft pull request, for up to 25 alerts at once.

Source: GitHub Changelog

GitHub moved agentic autofix for code scanning alerts from public preview to general availability on 15 October. Assign Copilot to an alert and it explores the relevant files, writes a fix, reruns CodeQL to confirm the alert clears, iterates if it doesn’t, and opens a draft pull request for review.

It only works on alerts found on a repository’s default branch, not on pull requests or other branches, and it caps out at 25 alerts per run. It’s available to GitHub Code Security and GitHub Advanced Security customers on GitHub Enterprise Cloud, including data residency deployments. Each run draws on your Code Security AI Credits budget as well as GitHub Actions minutes, both tracked under Advanced Security in enterprise billing.

Why it matters: this turns a security backlog from a list someone has to triage into pull requests someone just has to review. For a team sitting on hundreds of stale CodeQL alerts, that’s the difference between the backlog shrinking and it never getting touched. The 25-alert cap and default-branch-only scope mean it won’t clear everything in one pass, and the AI Credits cost is worth checking against your budget before pointing it at a large repository.

Share

Related reading

ML for Web Devs

Tokens, context windows, and why your bill is what it is

The unit of billing for language models is not the request or the word. Once you understand tokens and how a context window fills up, the invoice stops being a surprise.

ML for Web Devs

RAG is just search with extra steps

Retrieval-augmented generation gets written up like an architecture. It is a search query, a string concatenation and one API call, and the search query is the part that decides whether it works.

ML for Web Devs

A prompt is a spec, so write it like one

Prompt engineering has very little to do with magic words. It is the same skill as writing a clear ticket for a capable contractor who will not ask you any questions.

More from The Wire

All briefs

GitHub Copilot retires six AI models today

Gemini 3.7 Flash, GPT-5.5, GPT-5.4, GPT-5.4 mini, GPT-5 mini and Grok 4.5 stop working across Copilot Chat, inline edits, agent mode and completions from today.

via GitHub