GitHub's AI Scan for pull requests no longer needs CodeQL default setup

Previously the feature ran only where CodeQL default setup was configured, the changelog entry says. Code scanning and AI Scan for pull requests still have to be switched on at the repository, organization or enterprise level, and GitHub said no new setup steps are needed: organizations that already enabled AI Scan will see it run on more eligible repositories. The preview covers organization-owned and personal repositories.

GitHub's documentation describes AI Scan as a complement to CodeQL, aimed at code that CodeQL covers poorly or not at all. Examples include PHP, shell scripts, Terraform configuration and Dockerfiles, along with framework gaps such as JSP for Java and Blazor for C#. It runs when a pull request is opened and after each commit, works without a build, and posts findings next to CodeQL alerts with an AI label.

According to the documentation, the preview requires both a GitHub Advanced Security license and a GitHub Copilot license and consumes AI credits. AI Scan does not run on pull requests from forks or those created by Dependabot, cannot be used to enforce merge rules, and may produce false positives.