GitHub made AI Scan for pull requests generally available on Oct. 15, adding an AI-based security check for changed code in languages its CodeQL scanner does not cover. The findings appear beside CodeQL results, but remain advisory: they cannot fail a check or block a merge.
AI Scan looks for vulnerabilities outside CodeQL’s coverage
A pull request is a proposed code change submitted for review. GitHub’s CodeQL is a static-analysis system that checks code for security problems. AI Scan adds another security check for supported languages and code formats that CodeQL does not currently cover, including PHP, Shell and Bash, Terraform configuration, Dockerfiles, JSP for Java, and Blazor for C#.
When code scanning is enabled and the repository’s AI Scan setting is on, the service checks eligible pull requests when they open and after new commits. It can do this without a separate scanning tool or build setup. Findings show up on the pull request’s Conversation and Files changed tabs with an AI label, a risk explanation, and often a suggested remedy.
The findings inform review but cannot enforce a merge
AI Scan results are signals for developers to assess, not blocking checks. They do not fail the code-scanning check and cannot be made into merge requirements through rulesets. The tool also scans pull requests only; it does not scan an entire repository, and it skips pull requests from forks and those created by Dependabot.
GitHub’s launch announcement gives no detection-accuracy figures, and its documentation warns that AI Scan can produce false positives.
Availability depends on repository type, and scans use AI credits
AI Scan is available for public repositories owned by a person or organization. Private and internal organization repositories need GitHub Code Security or GitHub Advanced Security; private repositories in personal accounts are not listed as eligible. A GitHub Copilot license is not required.
Scans consume Code Security AI Credits when a qualifying pull request is analyzed. GitHub says credit use appears under “Advanced Security” in enterprise billing, where administrators can set budgets.
Image credit: Crew, via Wikimedia Commons; CC0 1.0. Illustrative photo, not a GitHub product image.
.jpg){kind=link}