AI Scan for pull requests is now generally available on GitHub. It runs automatically on PRs, surfaces AI‑generated security findings alongside CodeQL results, and targets languages and frameworks that CodeQL does not currently analyze.
Supported languages and coverage gaps
The service extends to PHP, Shell/Bash, Terraform configuration (HCL), Dockerfiles, JSP for Java, Blazor for C#, and other languages not covered by CodeQL. Findings appear in the Conversation and Files changed tabs with an “AI” badge, providing a brief risk explanation and an optional autofix suggestion.
Operational model and constraints
AI Scan activates only when code scanning is enabled and the repository’s effective AI Scan setting is turned on. It does not run on pull requests originating from forks or on PRs created by Dependabot. All findings are advisory; they never fail the code‑scanning check and cannot be used to enforce merge‑blocking rules in a ruleset.
Access requirements and billing impact
Public repositories owned by organizations or personal accounts can use AI Scan without additional licensing. Private or internal organization‑owned repositories require GitHub Code Security or GitHub Advanced Security. A separate Copilot license is not needed. Each AI Scan execution consumes Code Security AI Credits, which are reported in the “AI usage” section of enterprise billing under the Advanced Security product. Administrators can set SKU‑level budgets to cap credit consumption.
Related CloudNinjas coverage: security.
What This Means For Practitioners
Teams should enable the AI Scan setting in any repository where they already run code scanning to gain advisory coverage for the newly supported languages. Because findings are non‑blocking, pipelines should be updated to surface the alerts without treating them as failures, while still encouraging remediation via the provided autofix hints. Monitoring AI Credit usage is essential, especially for high‑volume repositories, to avoid unexpected billing spikes. Finally, practitioners must remember that AI Scan does not evaluate fork‑based contributions or Dependabot updates, so complementary review processes remain necessary for those sources.
