GitHub Agentic autofix for code scanning alerts GA
At a glance
Assign default-branch CodeQL/code-scanning alerts to Copilot: the agent explores the codebase, proposes a fix, reruns CodeQL to validate, iterates if needed, then opens a draft PR—batch up to 25 alerts or assign via REST with assignees ["copilot-swe-agent[bot]"]. This workflow is listed under security, agentic-fix, github, validation-loop, learnable-paradigm.
AI Scan is GA: it complements CodeQL by auto-scanning PR diffs for languages/frameworks CodeQL does not cover (PHP, Shell, Terraform HCL, Dockerfiles, JSP, Blazor, etc.), surfaces advisory findings with explanations and suggested autofix, and consumes Code Security AI Credits without blocking merges.
AWS Labs open-source (5k+★): one harness-neutral core turns Claude Code/Codex/Cursor/Copilot/Kiro/opencode into structured, verifiable delivery workflows via `aidlc config --harness` + doctor—install script, not a new agent.
GitLab 19.5 makes the MCP server GA on Free/Premium/Ultimate: Claude Code, Cursor, Codex and other MCP clients get consolidated tools (get_merge_request, get_pipeline) plus Duo Agent Platform flow handoff under existing GitLab permissions, with GitLab.com rate limits of 60/min Free and 600/min paid.
Empirical study: 34% of popular active repos ship agent instruction files (AGENTS.md dominant); half exceed ~100 lines; ~3/5 rules could be script-checked but <1/20 name the check—actionable lint: short map, name enforcers, one rulebook.