Agentic autofix generation for code scanning alerts [Public Preview] (#62062)

Co-authored-by: Melanie Yarbrough <11952755+myarb@users.noreply.github.com>

Author: sophietheking

content/code-security/concepts/code-scanning/autofix-for-code-scanning.md

@@ -0,0 +1,45 @@
+---
+title: About autofix for code scanning
+shortTitle: Autofix
+allowTitleToDifferFromFilename: true
+intro: 'Autofix provides targeted recommendations to help you fix {% data variables.product.prodname_code_scanning %} alerts and avoid introducing new security vulnerabilities.'
+product: '{% data reusables.rai.code-scanning.gated-feature-autofix %}'
+versions:
+  feature: code-scanning-autofix
+contentType: concepts
+category:
+  - Find and fix code vulnerabilities
+redirect_from:
+  - /code-security/concepts/code-scanning/copilot-autofix-for-code-scanning
+---
+
+Autofix provides you with targeted recommendations to help you fix {% data variables.product.prodname_code_scanning %} alerts so you can avoid introducing new security vulnerabilities. The potential fixes are generated automatically by large language models (LLMs) using data from the codebase and from {% data variables.product.prodname_code_scanning %} analysis.
+
+## How autofix works
+
+Autofix translates the description and location of a {% data variables.product.prodname_code_scanning %} alert into code changes that may fix it. It interfaces with the large language model {% data variables.copilot.copilot_gpt_53_codex %} from OpenAI, which has sufficient generative capabilities to produce both suggested fixes in code and explanatory text for those fixes.
+
+There are two ways to get a fix for an alert: agentic autofix and {% data variables.copilot.copilot_autofix_short %}. If {% data variables.copilot.copilot_cloud_agent %} is available in a repository, assigning an alert uses agentic autofix instead of {% data variables.copilot.copilot_autofix_short %}.
+
+## Agentic autofix
+
+> [!NOTE] This feature is currently in public preview and is subject to change.
+
+Assign a {% data variables.product.prodname_code_scanning %} alert to {% data variables.product.prodname_copilot_short %} to have it resolve the alert for you. Assigning an alert starts an agent session: {% data variables.copilot.copilot_cloud_agent %} calls tools to explore your codebase beyond the affected file, generates a fix, validates it (for example, by re-running {% data variables.product.prodname_codeql %}), and iterates until it opens a pull request with the changes. See [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/resolve-alerts#fixing-alerts-with-copilot).
+
+Keep the following in mind:
+
+* Agentic autofix requires {% data variables.copilot.copilot_cloud_agent %} and {% data variables.copilot.copilot_autofix_short %} to be available in the repository. If {% data variables.copilot.copilot_cloud_agent %} isn't available, assigning an alert falls back to {% data variables.copilot.copilot_autofix_short %} instead.
+* Each agentic autofix session is billed as a {% data variables.copilot.copilot_cloud_agent %} session and consumes {% data variables.product.prodname_ai_credits_short %}. See [AUTOTITLE](/copilot/concepts/agents/cloud-agent/about-cloud-agent#copilot-cloud-agent-usage-costs).
+* {% data variables.product.prodname_copilot_short %} follows any custom instructions configured for the repository or organization when it generates a fix.
+* Agentic autofix works on a best-effort basis. {% data variables.product.prodname_copilot_short %} validates fixes by re-running {% data variables.product.prodname_codeql %} using the code-scanning query suite, so it can't confirm that a fix resolves alerts generated by custom queries or the security-extended query suite. Fix quality for alerts from third-party tools is also not guaranteed.
+
+## Getting a suggested fix with {% data variables.copilot.copilot_autofix_short %}
+
+{% data variables.copilot.copilot_autofix_short %} generates a single suggested fix for an alert, which you review and apply yourself.
+
+You do not need a subscription to {% data variables.product.prodname_copilot %} to use {% data variables.copilot.copilot_autofix %}, and it does not consume {% data variables.product.prodname_ai_credits_short %}. {% data variables.copilot.copilot_autofix_short %} is available to all public repositories on {% data variables.product.prodname_dotcom_the_website %}, as well as internal or private repositories owned by organizations and enterprises that have a license for {% data variables.product.prodname_GH_code_security %}.
+
+{% data variables.copilot.copilot_autofix_short %} is allowed by default and enabled for every repository that uses {% data variables.product.prodname_codeql %}, regardless of whether it uses default or advanced setup for {% data variables.product.prodname_code_scanning %}. There is no separate step to enable {% data variables.copilot.copilot_autofix_short %}: enabling {% data variables.product.prodname_code_scanning %} with {% data variables.product.prodname_codeql %} is sufficient. See [AUTOTITLE](/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning).
+
+Administrators at the enterprise, organization, and repository levels can choose to disable {% data variables.copilot.copilot_autofix_short %}. If {% data variables.copilot.copilot_autofix_short %} has been disabled at your level, you can re-enable it by following the same steps used to disable it and selecting the option to allow {% data variables.copilot.copilot_autofix_short %}. To learn how to manage {% data variables.copilot.copilot_autofix_short %} at each level, see [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/disabling-autofix-for-code-scanning).

content/code-security/concepts/code-scanning/copilot-autofix-for-code-scanning.md

@@ -13,7 +13,7 @@ children:
   - /code-scanning
   - /code-scanning-alerts
   - /risk-assessment
-  - /copilot-autofix-for-code-scanning
+  - /autofix-for-code-scanning
   - /ai-powered-security-detections
   - /setup-types
   - /integration-with-code-scanning

content/code-security/concepts/code-scanning/index.md

@@ -1,8 +1,8 @@
 ---
-title: Disabling Copilot Autofix for code scanning security alerts
-shortTitle: Disable Copilot Autofix
+title: Disabling autofix for code scanning security alerts
+shortTitle: Disable autofix
 allowTitleToDifferFromFilename: true
-intro: You can block availability of {% data variables.copilot.copilot_autofix %} for security alerts for an enterprise or disable {% data variables.copilot.copilot_autofix %} at the organization and repository level.
+intro: 'You can disable {% data variables.copilot.copilot_autofix_short %}, which also blocks agentic autofix, for an enterprise, organization, or repository.'
 product: '{% data reusables.rai.code-scanning.gated-feature-autofix %}'
 versions:
   feature: code-scanning-autofix
@@ -13,16 +13,27 @@ category:
   - Find and fix code vulnerabilities
 ---
 
-{% data reusables.rai.code-scanning.copilot-autofix-note %}
+## Disabling agentic autofix
+
+Disabling agentic autofix can be done in two ways:
+
+1. By disabling {% data variables.copilot.copilot_autofix_short %} since agentic autofix relies on the same underlying setting. For instructions, see the sections below.
+1. By opting repositories out of {% data variables.copilot.copilot_cloud_agent %}. See [AUTOTITLE](/copilot/concepts/agents/cloud-agent/access-management#opting-repositories-out-of-copilot-cloud-agent).
+
+For more information about agentic autofix, see [AUTOTITLE](/code-security/concepts/code-scanning/autofix-for-code-scanning#agentic-autofix).
+
+## Disabling {% data variables.copilot.copilot_autofix_short %}
+
+You can disable {% data variables.copilot.copilot_autofix_short %} at the enterprise, organization, or repository level.
 
 Disabling {% data variables.copilot.copilot_autofix_short %} at any level will close all open {% data variables.copilot.copilot_autofix_short %} suggestions that were added as comments on {% data variables.product.prodname_code_scanning %} alerts in pull requests. If {% data variables.copilot.copilot_autofix_short %} is later re-enabled, suggestions will only be generated for pull requests opened after that point, or after re-running {% data variables.product.prodname_code_scanning %} security analysis on existing pull requests.
 
 > [!NOTE]
 > {% data variables.copilot.copilot_autofix_short %} is an integral part of {% data variables.product.prodname_code_quality %} and will continue to run on code quality results even when it is disabled for code security results.
 
-For more information about {% data variables.copilot.copilot_autofix_short %}, see [AUTOTITLE](/code-security/concepts/code-scanning/copilot-autofix-for-code-scanning).
+For more information about {% data variables.copilot.copilot_autofix_short %}, see [AUTOTITLE](/code-security/concepts/code-scanning/autofix-for-code-scanning).
 
-## Blocking use of {% data variables.copilot.copilot_autofix_short %} for an enterprise
+### Blocking use of {% data variables.copilot.copilot_autofix_short %} for an enterprise
 
 Enterprise administrators can disallow {% data variables.copilot.copilot_autofix_short %} for security results in their enterprise. If you disallow {% data variables.copilot.copilot_autofix_short %} for an enterprise, {% data variables.copilot.copilot_autofix_short %} cannot be enabled for any organizations or repositories within the enterprise.
 
@@ -35,7 +46,7 @@ Disallowing {% data variables.copilot.copilot_autofix_short %} at the enterprise
 {% data reusables.enterprise-accounts.code-security-and-analysis-policies %}
 1. Under "{% data variables.copilot.copilot_autofix_short %}", use the dropdown menu to choose "Not allowed."
 
-## Disabling {% data variables.copilot.copilot_autofix_short %} for an organization
+### Disabling {% data variables.copilot.copilot_autofix_short %} for an organization
 
 If {% data variables.copilot.copilot_autofix_short %} is allowed at the enterprise level, organization administrators have the option to disable {% data variables.copilot.copilot_autofix_short %} for an organization. If you disable {% data variables.copilot.copilot_autofix_short %} for an organization, {% data variables.copilot.copilot_autofix_short %} cannot be enabled for any repositories within the organization.
 
@@ -48,7 +59,7 @@ Disabling {% data variables.copilot.copilot_autofix_short %} at the organization
 
 For more information about configuring global {% data variables.product.prodname_code_scanning %} settings, see [AUTOTITLE](/code-security/securing-your-organization/enabling-security-features-in-your-organization/configuring-global-security-settings-for-your-organization#configuring-global-code-scanning-settings).
 
-## Disabling {% data variables.copilot.copilot_autofix_short %} for a repository
+### Disabling {% data variables.copilot.copilot_autofix_short %} for a repository
 
 If {% data variables.copilot.copilot_autofix_short %} is allowed at the enterprise level and enabled at the organization level, repository administrators have the option to disable {% data variables.copilot.copilot_autofix_short %} for a repository. Disabling {% data variables.copilot.copilot_autofix_short %} at the repository level will remove all open {% data variables.copilot.copilot_autofix_short %} suggestions that were added as comments on {% data variables.product.prodname_code_scanning %} alerts in pull requests across the repository.