GitHub's Copilot autofix now re-runs CodeQL before opening a PR

Copilot's autofix now re-runs CodeQL on its own patch before opening a pull request, per GitHub. The tool explores the flagged files, drafts a fix, and only opens it as a draft PR once the re-scan confirms the alert closed.

That verify step is the point. A fix that looks right and an alert that's actually closed are two different things, and whoever approves the PR usually pays for the gap.

I've shipped enough AI-assisted patches to trust the pattern here: checking the model's own claim beats trusting its judgment. Building the re-scan into the loop means a reviewer opens a PR that's already been confirmed clean.

The fix also lands differently than most autofix tools. GitHub's post describes remediation arriving as a reviewable pull request, not an inline hint buried in a code scanning tab.

That's a smaller change than the verify loop. But it means the fix competes for review time the way a human's PR would, with the CodeQL result already attached.

GitHub baking the re-scan into the loop is what separates this from a plain suggestion engine. Any competing autofix that skips that check should get called out for shipping unverified guesses. Worth watching whether the re-scan catches fixes that close the CodeQL alert but change behavior elsewhere in the file. GitHub's post doesn't say.