{"meta":{"title":"Fixing code quality findings on a pull request","intro":"Keep quality issues out of your default branch by applying autofixes, delegating remediation work to Copilot, or dismissing irrelevant findings.","product":"Security and code quality","breadcrumbs":[{"href":"/en/code-security","title":"Security and code quality"},{"href":"/en/code-security/how-tos","title":"How-tos"},{"href":"/en/code-security/how-tos/maintain-quality-code","title":"Maintain quality code"},{"href":"/en/code-security/how-tos/maintain-quality-code/fix-findings-on-a-pr","title":"Fix findings on a PR"}],"documentType":"article"},"body":"# Fixing code quality findings on a pull request\n\nKeep quality issues out of your default branch by applying autofixes, delegating remediation work to Copilot, or dismissing irrelevant findings.\n\n> \\[!TIP]\n> If you're new to Code Quality, see [Preventing code quality issues from reaching your default branch](/en/code-security/tutorials/improve-code-quality/catch-issues-before-merge?utm_campaign=code-quality-ga-july-2026\\&utm_medium=docs\\&utm_source=docs-fix-pr-findings-walkthrough-tip) for a guided walkthrough of how Code Quality works on pull requests.\n\n## How Code Quality works on pull requests\n\nWhen you open a pull request, Code Quality uses CodeQL to perform a rule-based scan of your changes and posts findings as comments by `github-code-quality[bot]`. Each finding includes a suggested autofix. Findings are labeled by severity (**Error**, **Warning**, **Note**), and administrators can set quality gates to block merges based on the severity of these findings.\n\n## Resolving a finding\n\n1. On GitHub, navigate to your open pull request.\n2. On the **Files Changed** tab, scroll to a comment left by **`github-code-quality[bot]`**.\n3. Carefully review the comment and the suggested autofix for logic, security, and style.\n4. If you agree with the suggestion and you want to apply the fix, click **Commit suggestion**, or **Add suggestion to batch**.\n5. Alternatively, if the finding isn't relevant or actionable, you can dismiss it by clicking **Dismiss finding**. For example, you might dismiss a finding that is in legacy code no longer maintained, is a known exception to your team's coding standards, or is a false positive that doesn't pose a real quality risk.\n\n## Delegating remediation work to Copilot\n\nIf you have a Copilot license, you can delegate the remediation work to Copilot cloud agent. Comment on the pull request mentioning `@Copilot` and request that Copilot fix the detected issues.\n\n\n\nCopilot responds with an eyes emoji (👀) to your comment, starts a new agent session, and opens a pull request with the necessary fixes.\n\nYou can track Copilot cloud agent's work:\n\n* In the pull request, the summary is updated as work progresses.\n* Using the [agents page](https://github.com/copilot/agents?ref_product=copilot\\&ref_type=engagement\\&ref_style=text) or session logs, see [Managing agent sessions](/en/copilot/how-tos/copilot-on-github/use-copilot-agents/manage-and-track-agents).\n\nYou need a Copilot license to invoke Copilot cloud agent. Sign up for Copilot\n\n## Next steps\n\n* [Viewing code coverage on pull requests](/en/code-security/how-tos/maintain-quality-code/view-coverage-on-prs)"}