GitHub releases AI scans, but they cannot block pull request merges
GitHub made AI Scan for pull requests generally available on October 15. It checks languages and frameworks that CodeQL does not cover today. The findings are advisory, so they cannot fail the code-scanning check or block merges through rulesets. AI Scan does not check pull requests from forks or Dependabot.
Verified 1:15 AM PDT · 2 original sources
GitHub also released agentic autofix. The tool proposes repairs, reruns CodeQL and opens a draft pull request for a person to review.
AI Scan requires code scanning and the relevant setting to be enabled, and it uses Code Security AI Credits. Private and internal organization repositories need Code Security or Advanced Security. Agentic autofix has separate eligibility on GitHub Enterprise Cloud. It needs administrator approval and a defined Copilot billing method, and uses AI Credits and Actions minutes. These are company-described tools. Passing a CodeQL recheck does not prove that all security problems are fixed.
Use in real repositories will show how often the tools raise false alarms, miss flaws or suggest repairs that developers accept. Their cost will matter too. AI Scan and agentic autofix have separate settings and eligibility rules.
Audit the story
Original sources
Company claims remain company claims. Follow the reporting and judge the evidence directly.
- GitHub ChangelogAI Scan for pull requests generally available ↗
- GitHub ChangelogAgentic autofix for code scanning alerts general availability ↗
Continue the edition