GitHub has made AI Scan for pull requests generally available. The feature complements CodeQL by finding vulnerabilities in pull request changes for languages and frameworks that CodeQL does not currently cover.
Covered technologies include PHP, Shell/Bash, Terraform configuration (HCL), Dockerfiles, JSP for Java, Blazor for C#, and more.
AI Scan runs automatically on pull requests when code scanning and the repository's effective AI Scan setting are enabled. Findings appear alongside CodeQL results on the Conversation and Files changed tabs, with an "AI" indicator to distinguish them. Findings can include an explanation of the security risk and a suggested autofix.
AI Scan findings are advisory. They do not fail the code scanning check and cannot block pull request merges through ruleset requirements. AI Scan does not run on pull requests from forks or pull requests created by Dependabot.
AI Scan is available for public repositories owned by organizations or personal accounts. For private and internal organization-owned repositories, GitHub Code Security or GitHub Advanced Security is required. A GitHub Copilot license is not required. AI Scan for pull requests consumes Code Security AI Credits.