On July 14, 2026 GitHub shipped AI security detections on pull requests. The changelog is one sentence long, and the important part is the qualifier: the feature is available "for customers with GitHub Code Security (GitHub Advanced Security)".
The changelog doesn't say which ecosystems it covers. The companion post does, verbatim:
ecosystems newly supported through AI-powered detections, including
Shell/Bash, Dockerfiles, Terraform configurations (HCL), and PHP
Those four have something in common: CodeQL's free tier doesn't analyze any of them. CodeQL covers C/C++, C#, Go, Java/Kotlin, JavaScript/TypeScript, Python, Ruby, Rust and Swift. If your repo is a pile of deploy scripts, a Dockerfile and some Terraform — which describes a lot of infrastructure repos — free code scanning has been giving you nothing, and the thing that would cover you is now a paid SKU.
The scanners for those four ecosystems already exist, are mature, and are free. What was missing is the part GHAS actually sells: unified reporting, SARIF in the Security tab, and a PR comment that tells you what changed. So I wired it up.
- uses: Booyaka101/ghas-free-pack@v1
with:
github-token: ${{ github.token }}
That runs ShellCheck over .sh
/.bash
, Hadolint over Dockerfile*
, tfsec over .tf
, and PHPStan over .php
— then merges every finding into one SARIF 2.1.0 document, uploads it to code scanning, and posts a grouped PR comment with rule links.
Findings land in the Security tab exactly like CodeQL's do, because SARIF is SARIF.
From the fixtures in the repo's own test suite, all real findings from the real scanners:
SC2163
— export $INPUT
exports the DL3002
— last USER
is root. Your container runs privileged.aws-ec2-no-public-ingress-sgr
— 0.0.0.0/0
ingress.enable-phpstan: true
). Most PHP projects need a tuned phpstan.neon
, and turning it on by default would bury you in noise on day one.security-events: write
pull-requests: write
. Without those it still runs and still writes a job summary, it just can't publish. Grant them explicitly:
permissions:
contents: read
security-events: write
pull-requests: write
I don't expect anyone to take a security tool's word for it, so the repo ships the harness I used: test/run-local.ps1
builds the image, runs it against test/fixtures
with a mocked GitHub API, and asserts 17 acceptance criteria — including that the merged SARIF validates against the SARIF 2.1.0 schema with ajv, that the PR comment contains the expected rules, and that a re-run PATCHes the existing comment in place instead of posting a second one.
One thing that cost me time and is worth writing down: the OASIS sarif-spec
raw URL for the 2.1.0 schema (master/Schemata/sarif-schema-2.1.0.json
) is 404 — the repo was restructured. The working copy is https://json.schemastore.org/sarif-2.1.0.json
, which declares draft-07 and validates fine with ajv 8 given strict: false
.
MIT. Repo: https://github.com/Booyaka101/ghas-free-pack