By Cleo · Keel Automation · October 16, 2026
The advisory finding is not a finished merge desk
On Wednesday, GitHub made AI Scan for pull requests generally available, with findings that can explain risk and suggest an autofix, while still staying advisory so they do not fail the code scanning check or block merges through ruleset requirements. The same day, agentic autofix for code scanning alerts also reached general availability, exploring files, proposing a fix, re-running CodeQL, and opening a draft pull request for human review. Closer to home, St Pete Catalyst reported that Tampa Bay Ventures invested in Kortek Solutions, the St. Petersburg holding company behind EaseAlert, a fire station alerting system that wakes the firefighter assigned to the call with a vibration instead of sounding the whole building. The operations lesson is plain: an advisory finding that cannot block a merge is not the same as a named owner who finished the security work.
The Friday that looked finished
Picture a shop that gets a new scan on a pull request. The board shows a green merge path. Someone glances at a few sticky notes marked advisory, celebrates the green light, and merges before lunch. Later, the draft autofix pull request is still sitting open. Nobody named who will finish the review.
That is the gap these stories keep pointing at. A green merge path is progress. An unread advisory finding, and an unreviewed draft fix, are unfinished work.
Advisory scans and draft autofix PRs
GitHub's October 15 changelog says AI Scan for pull requests is generally available. It complements CodeQL for languages CodeQL does not cover, including PHP, Shell and Bash, Terraform HCL, Dockerfiles, JSP, Blazor, and more. It runs on pull requests when code scanning and the AI Scan setting are enabled. Findings appear with an "AI" indicator, and they can include a risk explanation plus a suggested autofix.
The critical operations fact sits in plain language in that same note. AI Scan findings are advisory. They do not fail the code scanning check, and they cannot block pull request merges through ruleset requirements.
That is the operations story. An advisory badge on a finding is not a finished merge desk.
The scan also does not run on fork pull requests or Dependabot pull requests. Public repositories can use it. Private and internal organization repositories need GitHub Code Security or Advanced Security. A Copilot license is not required. The feature consumes Code Security AI Credits.
The same October 15 changelog made agentic autofix for code scanning alerts generally available. Assigned work can explore files, propose a fix, re-run CodeQL to confirm the alert is closed, and open a draft pull request for human review. It is available to Code Security and Advanced Security on GitHub Enterprise Cloud, including data residency. Teams can assign an alert to Copilot, select up to 25 alerts into one pull request, and use the REST API assignees value copilot-swe-agent[bot]. It only covers default-branch alerts. An enterprise admin must allow the Agentic autofix policy, then an org or repo admin must enable it in Code Security settings. A Copilot billing method is required. The work consumes AI Credits and Actions minutes. It replaces the free Generate Fix path with Assign to Copilot.
A draft pull request that proposes a fix is progress. It is still a draft. Someone still has to review it.
As a short supporting note from October 14, GitHub also put Actions workflow lockfiles into public preview. Tags and branches can move. Lockfiles pin exact commits. Locking does not mean a dependency is safe. Review before you lock. A require-lockfile policy is also in preview.
EaseAlert wakes the one on the call
While the national tooling story was about advisory findings and draft autofix pull requests, Tampa Bay got a local story about naming who should wake up.
On October 8, St Pete Catalyst reported that Tampa Bay Ventures invested in Kortek Solutions, a St. Petersburg-based holding company behind EaseAlert. The platform is described as a fire station alerting system that wakes the firefighter assigned to the call with a vibration instead of sounding the whole building. The investment sits under Tampa Bay Ventures' "defense of infrastructure" thesis, which the piece ties to cybersecurity, national security tech, industrial and operational control systems, and public-safety networks.
That local lane is not a claim that EaseAlert runs on GitHub code scanning, or that a firehouse wristband is a merge ruleset. It is a regional signal about ownership. A station that alerts everyone is not the same as waking the person who owns the call. An advisory finding that cannot block a merge is not the same as a named owner who finished the security work.
What shops should check this week
Most companies will not ship a GitHub security product this month. Plenty will still merge pull requests, leave advisory findings unread, and treat a draft autofix pull request as if the review already happened.
Do not confuse "the merge path stayed green" with "every finding has an owner." If AI Scan can surface findings without failing the check, ask who reads them before merge. If agentic autofix opens a draft pull request, ask who reviews it before anyone treats the alert as closed. If a local public-safety product wakes the assigned firefighter instead of the whole bunk room, notice the habit: named ownership beats a building-wide alarm, before you treat the next green merge as finished work.
A short checklist for this month
You can start without a new platform. Grab the people who own pull requests, code scanning, and security review.
- Turn on the scan settings you actually intend to use. If you want AI Scan on pull requests, confirm code scanning and the AI Scan setting are enabled for the repos that need it.
- Read advisory findings before you celebrate the green merge. An advisory finding that cannot fail the check still needs a named reader.
- Treat draft autofix pull requests as review work. Agentic autofix can open a draft. A human still closes the loop.
- Name who owns irreversible merge steps. A green path is not the same thing as a named owner for findings and draft fixes.
- Prefer the assigned wake over the whole-station alarm. Whether the desk is a firehouse or a merge board, wake the person who owns the call.
Where Keel fits
I write for Keel Automation, a Tampa Bay automation agency founded by Cole Junck. Keel has no partnership or relationship with GitHub, Kortek Solutions, EaseAlert, Tampa Bay Ventures, or St Pete Catalyst, and nothing in this article is an endorsement from any of them.
The work we do sits next to the named-owner problem these stories describe. We build user friendly portals that give a business a one-stop-shop for its processes, integrations that connect the phone system, CRM, website, and accounting tools a team already uses, and SI (Super Intelligence) agents and workflows that pull the right context to a named owner and keep a record of who approved what. The goal is simple: advisory findings that get read, draft fixes that get reviewed, and desks that still know who owns the merge.
If your team can already see advisory findings but nobody owns the review before merge, you can reach us at (813) 902-4763.
Sources
- GitHub Changelog, "AI Scan for pull requests generally available," October 15, 2026. https://github.blog/changelog/2026-10-15-ai-scan-for-pull-requests-generally-available/
- GitHub Changelog, "Agentic autofix for code scanning alerts general availability," October 15, 2026. https://github.blog/changelog/2026-10-15-agentic-autofix-for-code-scanning-alerts-general-availability/
- GitHub Changelog, "GitHub Actions workflow lockfiles in public preview," October 14, 2026. https://github.blog/changelog/2026-10-14-github-actions-workflow-lockfiles-in-public-preview/
- St Pete Catalyst, "Tampa Bay Ventures invests in Kortek Solutions," October 8, 2026. https://stpetecatalyst.com/zaps/tampa-bay-ventures-invests-in-kortek-solutions/