AI Scan PR now runs on pull requests even when the repository lacks the CodeQL default setup. The change removes a prerequisite that previously limited AI‑driven vulnerability detection to repos with CodeQL configured, extending coverage for any repository where code scanning and AI Scan are enabled at the appropriate level.
Scope and Enablement
The feature is available in public preview for organization‑owned and personal repositories on github.com, but only for customers with GitHub Advanced Security. No additional configuration steps are required beyond the existing enablement of code scanning and AI Scan at the repository, organization, or enterprise level. The same permission hierarchy that governs code scanning continues to apply.
Operational Impact
Practitioners should note the following operational considerations:
- Repositories that previously received no AI Scan feedback because they omitted the CodeQL default setup will now see AI‑generated security findings on pull requests.
- Existing CI/CD pipelines that already invoke code scanning do not need to be altered; the AI Scan engine will be invoked automatically where the enablement conditions are met.
- Because the change is a preview, behavior may still evolve. Teams should monitor the preview release notes for any adjustments to the enablement model.
Limitations
The preview does not extend to GitHub Enterprise Server; those installations will continue to require the CodeQL default setup for AI Scan on pull requests. Additionally, the feature is limited to repositories that are part of an organization or personal account on github.com and that have an active GitHub Advanced Security subscription.
Related CloudNinjas coverage: security.
What This Means For Practitioners
For AI engineers, cloud/platform engineers, DevOps/SRE, and security engineers, the immediate action is to verify that code scanning and AI Scan are enabled at the desired scope. Once confirmed, the broader repository coverage can be leveraged to surface AI‑driven vulnerability insights without the overhead of configuring CodeQL defaults. Teams should incorporate the new findings into their existing triage processes and keep an eye on the preview status, especially if operating on GitHub Enterprise Server where the change does not apply.
