GitHub Copilot now batch-fixes 25 code-quality findings into one PR
The Assign to Copilot button now takes up to 25 findings, fixes them on a branch, and opens one reviewed PR. GitHub also gates merges on leaked secrets.
Copy markdown
One button, 25 fixes, a PR to review
Select up to 25 standard Code Quality findings, hit Assign to Copilot, and Copilot fixes the batch agentically on a branch, validates its own changes, then opens a pull request for you to review and merge. The button replaces “Generate fix,” so one finding or 25 run through the same flow.
The catch: Team-and-up, and it spends AI credits
It only works on repos with GitHub Code Quality enabled on GitHub Team and Enterprise Cloud (including data residency) — not free or public repos. Each assignment consumes AI credits and follows your existing Code Quality policy, with no separate toggle to manage.
Merges now block on unresolved secret alerts
A new repository ruleset — “require secret scanning alerts are resolved” — stops a PR from merging until a secret scan finishes and no secrets it introduced are still open (public preview). It needs Secret Protection or Advanced Security and catches leaks at the PR layer that push protection can miss.
Also shipped: Copilot agent permissions and a wider GHAS trial
Enterprise admins can now centrally decide which Copilot agent operations are blocked, need approval, or run silently. Separately, more Enterprise Cloud orgs can self-serve a GitHub Advanced Security trial to evaluate Code Security.
Elsewhere: MiniCPM5-2B, a SOTA on-device model under Apache 2.0
OpenBMB’s 2.6B dense model (131k context, Apache 2.0) tops open-weights models under 4B on Artificial Analysis’s Intelligence Index while using among the fewest output tokens per task. Build this weekend: a local agentic helper that runs on a laptop or phone with no API keys. Weights are on Hugging Face.