AI Scan for pull requests generally available

GitHub made AI Scan for pull requests generally available, a code scanning feature that complements CodeQL by finding vulnerabilities in pull request changes for languages and frameworks CodeQL does not currently cover, including PHP, Shell/Bash, Terraform configuration (HCL), Dockerfiles, JSP for Java, and Blazor for C#. AI Scan runs automatically on pull requests when code scanning and the repository's effective AI Scan setting are enabled, and its findings are advisory — they do not fail the code scanning check and cannot block merges through ruleset requirements. AI Scan is available for public repositories owned by organizations or personal accounts, requires GitHub Code Security or GitHub Advanced Security for private and internal organization-owned repositories, and consumes Code Security AI Credits.

AI Scan for pull requests generally available Code scanning AI Scan for pull requests is now generally available. It complements CodeQL by finding vulnerabilities in pull request changes for languages and frameworks that CodeQL does not currently cover, including PHP, Shell/Bash, Terraform configuration HCL , Dockerfiles, JSP for Java, Blazor for C , and more. How it works how-it-works AI Scan runs automatically on pull requests when code scanning and the repository’s effective AI Scan setting are enabled. Findings appear alongside CodeQL results on the Conversation and Files changed tabs, with an “AI” indicator to distinguish them from CodeQL alerts. Findings can include an explanation of the security risk and a suggested autofix. AI Scan findings are advisory. They do not fail the code scanning check and cannot block pull request merges through ruleset requirements. AI Scan does not run on pull requests from forks or pull requests created by Dependabot. Availability availability AI Scan is available for public repositories owned by organizations or personal accounts. For private and internal organization-owned repositories, GitHub Code Security or GitHub Advanced Security is required. A GitHub Copilot license is not required. Billing billing AI Scan for pull requests consumes Code Security AI Credits. AI Credit usage is displayed in the “AI usage” section of enterprise billing and licensing as the “Advanced Security” product. You can also set SKU-level budgets for Code Security AI Credits. Learn more about usage-based billing https://docs.github.com/enterprise-cloud@latest/copilot/concepts/billing/usage-based-billing-for-organizations-and-enterprises . Learn more about AI Scan for pull requests https://docs.github.com/enterprise-cloud@latest/code-security/concepts/code-scanning/ai-powered-security-detections and billing for GitHub Advanced Security AI features https://docs.github.com/billing/concepts/product-billing/github-advanced-security how-ai-feature-usage-is-billed . Join the discussion in the AI Scan Community discussion https://github.com/orgs/community/discussions/201543 .