GitHub's AI Scan for Pull Requests Now Generally Available

What happened

GitHub announced that AI Scan for pull requests is now generally available. This feature extends GitHub's code scanning capabilities by detecting vulnerabilities in pull request changes for languages and frameworks that CodeQL, GitHub's primary static analysis tool, does not currently cover. Supported languages and frameworks include PHP, Shell/Bash, Terraform configuration (HCL), Dockerfiles, JSP for Java, and Blazor for C#.

How AI Scan works

AI Scan runs automatically on pull requests when code scanning and the repository's effective AI Scan setting are enabled. Results appear alongside CodeQL findings on both the Conversation and Files changed tabs within the pull request interface. Each AI-generated finding is marked with an 'AI' indicator to distinguish it from CodeQL alerts. Findings may include an explanation of the security risk and a suggested autofix for developers to consider.

AI Scan findings are advisory in nature. They do not fail the code scanning check and cannot block pull request merges through ruleset requirements. The feature does not run on pull requests from forked repositories or pull requests created by Dependabot.

Who it affects and availability

AI Scan is available for public repositories owned by organizations or personal accounts at no additional cost beyond the existing code scanning infrastructure. For private and internal organization-owned repositories, GitHub Code Security or GitHub Advanced Security subscriptions are required. A GitHub Copilot license is not required to use AI Scan.

Billing and usage tracking

AI Scan for pull requests consumes Code Security AI Credits, which are separate from general code scanning. AI Credit usage is displayed in the 'AI usage' section of enterprise billing and licensing under the 'Advanced Security' product category. Organizations can set SKU-level budgets for Code Security AI Credits to manage costs.

Implications for developers

Developers working with languages outside CodeQL's current scope—particularly those using PHP, Bash, Terraform, or containerized deployments with Dockerfiles—now have automated vulnerability detection during code review. Since findings are advisory and non-blocking, they provide security insights without delaying pull request merges. Teams should review the security risks and suggested fixes as part of their normal code review process, while understanding that these alerts complement rather than replace CodeQL's deeper analysis.

Source

AI-assisted, verified against the source. This post was drafted with AI from the primary source linked above and checked automatically against it. For anything you depend on, read the original.