GitHub has added a public preview that exposes a repository_scan toggle via its code‑scanning REST API, allowing organizations and individual repositories to turn AI Scan on or off programmatically. For teams that manage dozens or hundreds of repos, the ability to script this change removes a manual bottleneck and aligns the feature with existing infrastructure‑as‑code workflows.
API Changes
The new capability is accessed through the same endpoints that already control pull‑request scanning (pr_scan). Both GET and PATCH operations now accept a repository_scan field:
GET /orgs/{org}/code-scanning/ai-scanPATCH /orgs/{org}/code-scanning/ai-scanGET /repos/{owner}/{repo}/code-scanning/ai-scanPATCH /repos/{owner}/{repo}/code-scanning/ai-scan
Setting repository_scan to enabled or disabled mirrors the behavior of pr_scan: an organization‑level disable blocks all repos, an organization‑level enable allows inheritance, and individual repos can opt out.
{
"repository_scan": "enabled",
"pr_scan": "enabled"
}
Operational Impact
Because the toggle is now API‑driven, teams can embed it in CI/CD pipelines, Terraform modules, or custom scripts. This makes bulk roll‑outs and roll‑backs repeatable and auditable. The change does not automatically start a scan; scans must still be triggered manually or via existing automation, and each run consumes GitHub Code Security AI credits. When an organization attempts to enable a setting that conflicts with an enterprise policy, the API returns a 422 error, and no partial updates occur if either pr_scan or repository_scan is blocked.
Security and Governance Considerations
Only organization owners and security managers can modify the organization‑level setting, while repository administrators can opt a single repo out. The feature is limited to public repos owned by organizations and to private or internal repos that already have GitHub Code Security or GitHub Advanced Security. Enterprise owners must first allow AI Scan in the enterprise policy; otherwise, any enable request fails with 422. GitHub Enterprise Server does not support this preview.
Related CloudNinjas coverage: security.
What This Means For Practitioners
- Integrate the PATCH call into your IaC pipeline to enforce a baseline AI Scan posture across all new repositories.
- Implement error handling for 422 responses to surface policy mismatches early in the deployment process.
- Track credit consumption separately, as enabling the toggle does not start scans but does not prevent on‑demand runs.
- Review organization and enterprise policies to ensure AI Scan is permitted before automating enablement.
- Document the ownership model: organization owners/security managers for global settings, repo admins for opt‑outs.