Assign default-branch CodeQL/code-scanning alerts to Copilot: the agent explores the codebase, proposes a fix, reruns CodeQL to validate, iterates if needed, then opens a draft PR—batch up to 25 alerts or assign via REST with assignees ["copilot-swe-agent[bot]"].
AI Scan is GA: it complements CodeQL by auto-scanning PR diffs for languages/frameworks CodeQL does not cover (PHP, Shell, Terraform HCL, Dockerfiles, JSP, Blazor, etc.), surfaces advisory findings with explanations and suggested autofix, and consumes Code Security AI Credits without blocking merges.