Code scanning AI Scan no longer requires CodeQL default setup

GitHub announced that AI Scan for pull requests now runs on repositories without CodeQL default setup enabled, removing the previous requirement that CodeQL default setup be configured. The change is in public preview for organization-owned and personal repositories on github.com for GitHub Advanced Security customers, while GitHub Enterprise Server is not supported for this release. Code scanning and AI Scan for pull requests must still be enabled at the repository, organization, or enterprise level, and no new setup step is required.

Code scanning AI Scan no longer requires CodeQL default setup You can now use AI Scan for pull requests to find security vulnerabilities, even when CodeQL default setup isn’t enabled on a repository. Previously, AI Scan for pull requests only ran on repositories where CodeQL default setup was configured. What’s changed whats-changed Code scanning and AI Scan for pull requests must still be enabled at the repository, organization, or enterprise level, if the organization belongs to an enterprise. The same permission hierarchy still applies. There’s no new setup step. If you’ve already enabled GitHub code scanning’s AI Scan for your organization, it now runs more broadly across your eligible repositories, regardless of whether CodeQL default setup is configured. This change is now in public preview for organization-owned and personal repositories on github.com for GitHub Advanced Security customers. GitHub Enterprise Server is not supported for this release. To learn more, see our docs about AI-powered security detections https://docs.github.com/code-security/concepts/code-scanning/ai-powered-security-detections . Join the discussion and leave feedback on GitHub Community https://github.com/orgs/community/discussions/201543 .