Skip to content

GitHub AI Scan for pull requests reaches general availability

AI Scan now covers vulnerabilities in PHP, Shell, Terraform, Dockerfiles, JSP and Blazor, languages CodeQL does not scan, with findings shown inline on every pull request.

Source: GitHub

GitHub’s AI Scan for pull requests is generally available as of 15 October, moving out of preview. It finds vulnerabilities in pull request changes for languages and frameworks CodeQL does not currently cover, including PHP, Shell and Bash, Terraform, Dockerfiles, JSP and Blazor.

Findings show up on the Conversation and Files Changed tabs with an “AI” label to distinguish them from CodeQL alerts, often with an explanation and a suggested autofix. AI Scan is advisory only: it does not fail the code scanning check and cannot block a merge through ruleset requirements. It runs on public repositories for all accounts; private and internal repos need GitHub Code Security or Advanced Security, billed through Code Security AI Credits. It does not run on fork pull requests or Dependabot PRs, and needs no Copilot licence.

Why it matters: PHP has never had CodeQL coverage on GitHub, so WordPress, Laravel and plain PHP projects are getting their first native vulnerability scanning on pull requests here, not a bolt-on from a third-party Action.

The caveat: findings are advisory only. Nothing stops a vulnerable PHP change from merging unless someone reads the AI Scan annotation first.

Share

Related reading

Engineering

The N+1 you cannot see

Everyone knows to eager load. The queries that actually take sites down are the ones hiding in an accessor, a Blade partial, or a policy. There is a one-line switch that finds all of them.

Engineering

Queues are not optional

If your request handler calls somebody else’s API, you have already built a distributed system. The queue is how you stop their bad day from becoming your bad day.

Engineering

PHP got good and nobody told you

If your mental image of PHP is from 2014, it is wrong in ways that would change your architecture. Here is what actually landed, and which parts change how you write code.

More from The Wire

All briefs

GitHub Copilot retires six AI models today

Gemini 3.7 Flash, GPT-5.5, GPT-5.4, GPT-5.4 mini, GPT-5 mini and Grok 4.5 stop working across Copilot Chat, inline edits, agent mode and completions from today.

via GitHub