Copilot Autofix for code security alerts (Preview)

Copilot Autofix provides agentic remediation for code scanning alerts and dependency scanning security vulnerabilities in GitHub Advanced Security for Azure DevOps. Open a supported alert and select Generate fix. The Copilot coding agent can explore relevant repository context, review and refine its proposed changes, and open a pull request with a suggested fix.

You review, test, and merge the change through your normal pull request workflow. The steps are the same for both alert types. Choose the relevant alert list to start, and then use the relevant scanner to verify the merged fix.

GitHub Advanced Security for Azure DevOps works with Azure Repos. To use GitHub Advanced Security with GitHub repositories, see GitHub Advanced Security.

Prerequisites

For more information about Advanced Security permissions, see Manage Advanced Security permissions.

• Code scanning or dependency scanning configured and producing alerts for your repository.
• At least one supported alert.
• The Advanced Security: view alerts repository permission for the user who selects Generate fix.
• Access to the Azure Pipelines agent pool. Copilot Autofix queues a Microsoft-hosted pipeline job to generate and publish the fix. The run requires an available parallel job. If all parallel jobs are in use, the fix remains queued until capacity becomes available.

Copilot Autofix performs repository operations by using a dedicated identity named GitHub Copilot ({organization}), not a project or collection Build Service account. The service automatically grants the identity the following permissions:

You don't need to grant these permissions to a Build Service account. If your organization uses explicit deny permissions, verify that they don't block the GitHub Copilot ({organization}) identity.

How agentic Autofix works

Agentic Autofix uses the alert's findings and your repository context, rather than relying only on the reported code location. The Copilot coding agent can use checked-in custom instructions and relevant skills to understand your coding standards, architecture, and remediation patterns. It can review and refine the proposed change before opening a pull request that contains:

• A suggested code change that addresses the underlying vulnerability.
• A description of the alert being fixed, including the alert ID, severity, and a summary of the change.

Because the suggested fix considers the broader context of your code base, the change can span more than the single line where the alert was raised, and can include changes to other files where needed.

Supported alerts

For either supported alert type, Copilot Autofix proposes a change for you to review. It doesn't guarantee a fix for every finding. For more information, see Fix isn't available.

Provide repository instructions and skills

Give agentic Autofix the context you want it to consider when generating a fix. Check custom instructions and skills into the repository in supported .github or .agents locations. These files can help the Copilot coding agent follow your team's coding standards and established remediation workflows.

Add coding standards to custom instructions

Use repository-wide custom instructions, such as .github/copilot-instructions.md, to describe how changes should fit your project. Include guidance about naming conventions, approved libraries, architectural boundaries, and how to build and test changes.

For example, if your team requires a shared input-validation helper, describe that requirement in the instructions. Don't assume that the agent will infer it from the alert.

# Coding standards

- Use the existing input-validation helpers instead of adding new validation logic.
- Follow the naming conventions in the surrounding code.
- Keep dependency changes scoped to the vulnerability being fixed.
- Update the relevant tests when a fix changes behavior.
- Run the documented build and test commands before proposing a change.

Use Copilot's supported file names and locations. A file named custom-instructions.md doesn't, by its name alone, establish a repository-wide Copilot instruction file. For the repository-wide file format, see Adding repository custom instructions for GitHub Copilot.

Add skills for repeatable remediation tasks

Repository skills can provide task-specific instructions, scripts, and supporting resources. Store a skill in a directory such as .github/skills/<skill-name>/ or .agents/skills/<skill-name>/, with its instructions in SKILL.md.

For example, a dependency-update skill can describe your package-update procedure and compatibility checks. A code-remediation skill can describe how to use your approved security libraries. Agentic Autofix can reference relevant skills as part of generating a fix; not every skill applies to every alert. For the skill format, see About agent skills.

Billing

Copilot Autofix is included with your GitHub Advanced Security for Azure DevOps license. Generating a fix consumes AI credits from your organization's Azure billing meter.

Each fix generation consumes tokens, which include input tokens for the code context sent to the model, output tokens for the suggested change, and cached tokens that reuse existing context.

To keep billing simple, these tokens are converted into a standard unit called a GitHub AI credit, where 1 credit equals $0.01 USD. The charges are billed to the Azure subscription linked to your Azure DevOps organization and appear as a separate meter in Azure Cost Management.

The cost of each fix varies with the size of the surrounding code context and the complexity of the change.

View Autofix costs by project

Copilot Autofix supports organization and project tags so you can filter its usage charges and compare costs across Azure DevOps projects.

1. In the Azure portal, open the subscription linked to your Azure DevOps organization. Go to Cost Management > Cost analysis.
2. Select the date range you want to review.
3. Add a Meter filter and select AI Credit for AzDO GAC. This filter isolates Autofix usage charges from other subscription costs.
4. Add a tag filter for _organizationname_ and select the Azure DevOps organizations whose costs you want to view.
5. Set Group by to the _projectname_ tag to see the Autofix cost breakdown by project.

To review individual dates, set Granularity to Daily and switch the visualization to Table. Keep the meter and organization filters and the project grouping. You can also filter the _projectname_ tag to limit the table to specific projects.

Enable Copilot Autofix

You can enable Copilot Autofix at the organization, project, or repository level. When you enable Autofix at a broader scope, the setting applies to all repositories within that scope. Choose where to configure Autofix based on the repositories you want the setting to apply to:

To enable Copilot Autofix:

1. Sign in to your Azure DevOps organization (https://dev.azure.com/{yourorganization}).
2. Go to the settings page for the organization, project, or repository scope that you want to configure.
3. In the Advanced Security section, locate Autofix for security alerts. If you use standalone Code Security, select Options to open the Code Security features panel.
4. Select Autofix for security alerts. The same setting enables Copilot Autofix for supported code scanning and dependency scanning alerts.
5. If you use the Code Security features panel, select Apply to save your changes.

For screenshots of both the bundled Advanced Security and standalone Code Security settings, see Configure Copilot Autofix.

Enabling Autofix doesn't configure scanning or generate fixes automatically. First, configure code scanning or dependency scanning. Then, request a fix from a supported alert.

Generate a fix for an alert

After you enable Copilot Autofix, use the same steps for a supported code scanning alert or dependency vulnerability alert.

1. Select Repos > Advanced Security.
2. Open the code scanning or dependency scanning alert list, and then select an alert to open its detail view.
3. Review the finding, affected code or dependency, and remediation guidance.
4. Select Generate fix.

The following code scanning examples illustrate the shared workflow. A dependency scanning example shows a generated pull request later in this section.

While Copilot Autofix works on the fix, the alert detail view shows that the fix is in progress. Copilot Autofix opens a pull request when the fix is ready.

Copilot Autofix generates the fix and opens a pull request from a branch named copilot-autofix/.... The pull request is labeled with a Copilot Autofix tag, which you can use to identify Autofix pull requests in the pull requests list.

Only one fix can be active for the same alert and branch. While a request is pending or its pipeline is running, Generate fix is unavailable. If another request is submitted at the same time, the alert shows that a fix is already being generated. You can generate another fix after the active request succeeds or fails.

For CodeQL alerts, the pull request appears automatically under Related pull requests on the alert detail view and continues to update as generation and completion progress, so you don't need to refresh the page.

The following dependency scanning example shows an active Autofix pull request for a vulnerable package under Related pull requests.

If Copilot Autofix doesn't produce any code changes for the alert, it doesn't create a branch or a pull request, and it doesn't link a pull request on the alert detail view. In this case, remediate the alert manually. For more information, see Fix isn't available.

Review and merge the fix

The pull request that Copilot Autofix opens behaves like any other Azure Repos pull request. Its description summarizes the alert that the fix addresses.

The Copilot Autofix label identifies autofix pull requests.

1. Open the pull request from the alert's Related pull requests section, or from Repos > Pull requests.
2. Review the proposed change in the Files tab across all affected files.
3. Edit the change if you need to match your code style, naming conventions, or project requirements.
4. Approve and complete the pull request through your normal review workflow.

After you merge the pull request, run the relevant scanner on the merged target branch. Copilot Autofix doesn't run this post-merge scan.

Merging a pull request alone doesn't close the alert. Advanced Security updates the alert state after it processes the new scanning results. Verify that those results no longer report the vulnerability.

Troubleshoot Copilot Autofix

Fix in progress

Most Copilot Autofix runs complete in about 2-5 minutes. Run time can vary based on the available pipeline capacity and the complexity of the change. If all parallel jobs are in use, the pipeline remains queued and the alert continues to show Fix in progress until capacity becomes available.

A request that remains pending before a pipeline is queued fails after 30 minutes. A queued or running pipeline has a two-hour timeout. The alert might stop updating automatically before the backend timeout is reached. If the alert remains in progress:

1. Refresh the alert detail page.
2. If View run is available, open the pipeline run and check whether it's queued or running.
3. Wait for the request to reach a succeeded or failed state. Don't submit another request while the existing request is active.
4. If the request fails, review the failure message and select Retry fix after you address the cause.

Pull request created but not linked to the alert

The pull request can be created successfully before it appears under Related pull requests. Refresh the alert detail page. If the pull request still isn't linked, select Repos > Pull requests and look for:

• The Copilot Autofix label.
• A source branch that begins with copilot-autofix/.
• A pull request title or description that references the alert.

Review and merge the pull request through the normal pull request workflow, even if the link doesn't appear on the alert.

Repository or pull request operations fail

Copilot Autofix performs a shallow clone of the branch associated with the alert. It doesn't initialize Git submodules. It creates a uniquely named copilot-autofix/... branch, pushes the generated change, and opens a pull request that targets the alert branch.

Use View run from the alert failure state to inspect the pipeline logs. The following table lists common causes and actions:

A fix was generated but couldn't be committed or pushed

Copilot Autofix uses noreply@dev.azure.com as the commit author email. If a commit author email validation policy doesn't allow this address, Copilot Autofix can generate the code change but can't commit or push it to create the pull request.

The alert detail view shows an error that identifies the blocked commit author email.

Add noreply@dev.azure.com to the allowed email patterns in the commit author email validation policy:

1. Select Project settings > Repositories.
2. Select All Repositories to update the project-level policy, or select the repository that has the policy.
3. Select Policies.
4. Under Repository Policies, find Commit author email validation.
5. Add noreply@dev.azure.com to the allowed email patterns.
6. Return to the alert and select Retry fix.

A run fails

If a Copilot Autofix run can't complete, the alert shows a prominent failure state so you can quickly see that the run didn't succeed. From the failure state, you can retry the run to generate a new fix.

A run can fail for transient reasons, or when the run doesn't produce a usable code change. Retry the run to generate the fix again.

An alert remains open after you merge the fix

Merging an Autofix pull request doesn't close the alert by itself. Advanced Security needs new results from the scanner that reported the finding. If the alert remains open:

1. Verify that the pull request was merged into the same branch where the alert was detected.
2. Confirm that code scanning or dependency scanning, as appropriate, ran after the merge and analyzed the merged commit.
3. Confirm that Advanced Security processed the updated results for the correct repository and branch.
4. Review the new results to verify that the vulnerability is no longer detected.
5. If the vulnerability is still present, update the fix and run the relevant scanner again.

Fix isn't available

Copilot Autofix can't generate a fix for every alert. A fix might not be available when:

• The alert type isn't currently supported by Copilot Autofix.
• Copilot determines that the alert could be a false positive.
• Copilot Autofix runs but doesn't produce any code changes. In this case, no branch or pull request is created.

If Copilot Autofix determines that the alert could be a false positive and doesn't produce any changes, the alert detail view shows the result. You can review the run or retry the fix.

When a fix isn't available, use the alert's remediation guidance to fix it manually. Dismiss an alert only after you review the finding and determine the appropriate dismissal reason. For more information, see Code scanning alert details and Dependency scanning alert details.

Related articles

• Set up code scanning
• Troubleshoot code scanning
• Set up dependency scanning
• Troubleshoot dependency scanning
• Configure GitHub Advanced Security features