GitHub

Recently shipped general availability for AI Scan on pull requests and agentic autofix for code scanning alerts, plus workflow lockfiles in preview.

Code scanning split duties across two GA features.

• AI Scan covers languages CodeQL does not — PHP, Shell/Bash, Terraform HCL, Dockerfiles, JSP, Blazor — posting advisory findings and autofixes on the Conversation and Files changed tabs.
• Agentic autofix explores the codebase, proposes a fix, reruns CodeQL to confirm the alert closes, then opens a draft pull request for review.
• CodeQL 2.27.2 added a C++ regex parser plus Go, Rust, and JavaScript analysis work.

Actions workflows can pin dependencies. Lockfiles are in public preview: runs stay on the exact commits you locked, even if tags or branches move afterward. Create and maintain them with the gh actions-lock CLI extension.

Copilot's model lineup turned over.

• Gemini 4 Argon is generally available, billed at provider list pricing.
• HydraFusion and new HydraFusion Max draw on Claude Opus 5.5, GPT-6 Astra, GPT-6.1 Sol, and GPT-6 Luna, tailoring reasoning effort per step.
• Claude Opus 4.8, Claude Opus 5, and GPT-5.6 Terra retire November 16; move to Opus 5.5, GPT-6.1 Sol, or GPT-6 Luna.

Push attribution records the authenticated pusher. Commits now carry durable pusher identity separate from author and committer strings, and a Committer must match pusher rule blocks mismatches. New GitHub App permissions support least-privilege tokens.

Deprecations to track. The stateless token validation header goes away November 30; macos-14 runner labels retire November 2.