GitHub AI Scan for pull requests is generally available, covering PHP, Shell, Terraform and Dockerfiles that CodeQL misses, including on public repositories
Code scanning fills CodeQL’s language gaps, but findings are advisory and never block merges.
// Key points
- It scans pull request changes in languages and frameworks CodeQL doesn’t cover yet, including PHP, Shell/Bash, Terraform (HCL), Dockerfiles, JSP for Java and Blazor for C#.
- Findings show on the Conversation and Files changed tabs with an AI indicator and can include a risk explanation and suggested autofix; they don’t fail the code scanning check and can’t block merges through rulesets.
- It is available on public repositories owned by organizations or personal accounts; private and internal org repositories need GitHub Code Security or GitHub Advanced Security, and no Copilot license is required.
- It doesn’t run on pull requests from forks or from Dependabot; it consumes Code Security AI Credits, with SKU-level budgets available.
Builder's takeOur deploy scripts, Dockerfiles and Terraform are exactly what CodeQL never scanned, and public repos can turn this on now. I’ll enable it on this site’s public repo first to see what it flags in the Shell steps of our GitHub Actions; since it only advises and never blocks, log false positives and misses for two weeks before deciding whether to wire its results into review rules.