GitHub has made it possible to direct code scanning alerts to Copilot for assistance in automated remediation. The capability broadens the scope of Copilot coding agent functionality to encompass security vulnerabilities, allowing teams to address common issues more rapidly.
By pairing Copilot coding agent with Copilot Autofix, development teams can cut down the effort spent on planning and executing security fixes. The workflow begins by generating an autofix suggestion for your code scanning alerts either through GitHub's alert pages, within a security campaign, or via the REST API. After that, Copilot can be assigned to begin the remediation process using one of two methods.
Assignment Methods
Bulk assignment
Navigate to a security campaign within your repository, select multiple alerts, and use the Assign Copilot option to address several alerts through a single pull request.
Individual assignment
From the alert detail page, assign Copilot to specific alerts for more granular, targeted remediation.
Once Copilot receives an assignment, it examines the vulnerability, develops a remediation strategy, and initiates a draft pull request. Upon completion of the code modifications, the pull request becomes available for team review. The GitHub interface includes tracking links that allow you to monitor the status of each pull request with ease.
The feature is currently accessible to organizations with GitHub Code Security or GitHub Advanced Security subscriptions alongside Copilot coding agent access on GitHub Enterprise Cloud.
Source: GitHub Blog