代码扫描警报的 Agentic 自动修复功能正式可用

代码扫描警报的 Agentic 自动修复功能现已正式可用。它会像开发者一样在整个代码库中开展修复工作：探索相关文件、提出修复方案，并重新运行 CodeQL 以确认修复能够关闭警报，然后创建一个拉取请求供你审查。Agentic 自动修复功能面向 GitHub Enterprise Cloud 上的 GitHub Code Security 和 GitHub Advanced Security 客户提供，包括启用了数据驻留的 GitHub Enterprise Cloud。

当你将代码扫描警报分配给 Copilot 时，它会：

• 探索代码库中的相关文件。
• 生成建议的修复方案。
• 通过重新运行 CodeQL 验证修复是否有效。
• 在必要时进行迭代，然后创建一个可供你审查的草稿拉取请求。

该拉取请求会包含修复摘要、该修复为何能够关闭警报，以及 Copilot 为确认修复有效所执行的验证步骤。当包含修复的拉取请求准备就绪后，你可以通过在拉取请求中发表评论，或在仓库的 Agents 标签页中与会话交互，指示 Copilot 对其作出进一步修改。

启用后，Agentic 自动修复会将单个代码扫描警报中免费的 Generate Fix 选项替换为 Assign to Copilot 按钮。

你可以通过以下方式使用 Agentic 自动修复：

• 在仓库默认分支上的任意代码扫描警报中，将该警报分配给 Copilot。
• 在仓库或安全活动中的安全警报列表里，选择最多 25 个警报，让 Copilot 在单个拉取请求中一并修复。
• 通过 更新代码扫描警报 REST API，将 assignees 设置为 ["copilot-swe-agent[bot]"]。

Agentic 自动修复支持仓库默认分支上的代码扫描警报。仅在拉取请求或其他分支中检测到的警报无法分配给 Copilot。

Agentic 自动修复要求企业管理员通过 Advanced Security 策略中新推出的“Agentic autofix”策略启用访问权限。

企业管理员启用该策略后，组织或仓库管理员即可在组织或仓库的 Code Security 设置中开启 Agentic 自动修复。

使用该功能还需要预先定义 Copilot 计费方式。

代码扫描警报的 Agentic 自动修复会消耗 Code Security 预算中的 AI Credits 和 GitHub Actions 分钟数。AI Credit 使用情况将以“Advanced Security”产品的形式显示在企业计费与许可页面的“AI usage”部分。你还可以为 Code Security AI Credits 设置 SKU 级别的预算。进一步了解 Copilot 按使用量计费。

进一步了解文档中的 Agentic 自动修复。

欢迎在 GitHub Community 中参与讨论。

Agentic autofix for code scanning alerts is now generally available. It remediates alerts by working across your codebase the way a developer would: it explores relevant files, proposes a fix, and reruns CodeQL to confirm the fix closes the alert before opening a pull request for your review. Agentic autofix is available to GitHub Code Security and GitHub Advanced Security customers on GitHub Enterprise Cloud, including GitHub Enterprise Cloud with data residency.

When you assign a code scanning alert to Copilot, it:

• Explores relevant files across your codebase.
• Generates a proposed fix.
• Validates the fix works by rerunning CodeQL.
• Iterates if needed, then opens a draft pull request ready for your review.

The pull request includes a summary of the fix, why it closes the alert, and the validation steps Copilot took to confirm that it works. When the pull request containing the fix is ready, you can instruct Copilot to make further changes to it by commenting on the pull request or interacting with the session in the Agents tab of your repository.

When enabled, agentic autofix replaces the free Generate Fix option on individual code scanning alerts with an Assign to Copilot button.

You can use agentic autofix:

• From any code scanning alert on the repository’s default branch, by assigning the alert to Copilot.
• In the list of security alerts in your repository or security campaign, by selecting up to 25 alerts for Copilot to fix together in a single pull request.
• Via the Update a Code Scanning Alert REST API by setting assignees to ["copilot-swe-agent[bot]"].

Agentic autofix supports code scanning alerts on the repository’s default branch. Alerts detected only on pull requests or other branches cannot be assigned to Copilot.

Agentic autofix requires an enterprise administrator to enable access to it via the new “Agentic autofix” policy in Advanced Security policies.

Once the policy is enabled by an enterprise administrator, an organization or repository administrator can turn on agentic autofix in the Code Security settings for the organization or the repository.

Access also requires a Copilot billing method to be defined.

Agentic autofix for code scanning alerts consumes AI Credits from your Code Security budget and GitHub Actions minutes. AI Credit usage will be displayed in the “AI usage” section of enterprise billing and licensing as the “Advanced Security” product. You can also set SKU level budgets for Code Security AI credits. Learn more about Copilot usage-based billing.

Learn more about agentic autofix in the documentation.

Join the discussion within the GitHub Community.