AI Scan removes a CodeQL prerequisite

GitHub says AI Scan for pull requests can now be used to find security vulnerabilities without CodeQL default setup enabled on a repository. Previously, the AI-powered scanning feature only ran on repositories where that CodeQL configuration had been set up.

The change broadens where AI Scan can operate without requiring repository administrators to complete an additional CodeQL setup step first. Its purpose, according to GitHub’s announcement, is to make the pull-request security detection available across more eligible repositories while keeping the existing enablement model in place.

Existing enablement rules remain

The removal of the CodeQL default setup requirement does not mean that AI Scan runs automatically on every repository. GitHub states that both code scanning and AI Scan for pull requests must still be enabled at the repository, organization, or enterprise level when the organization belongs to an enterprise.

That permission hierarchy is unchanged. Access therefore continues to depend on the level at which the relevant security features have been enabled. The announcement does not describe a new permission model or a replacement for the existing controls.

No new setup step for current users

GitHub says there is no new setup step associated with the update. Organizations that have already enabled GitHub code scanning’s AI Scan feature can now use it across a broader set of eligible repositories, including repositories where CodeQL default setup is not configured.

This means the change is focused on eligibility rather than a new configuration workflow. Existing customers do not need to add a separate setup action to take advantage of the expanded behavior, provided the required scanning and AI Scan settings are already enabled at the applicable level.

Public preview reaches eligible repositories

The expanded behavior is now in public preview for organization-owned and personal repositories hosted on github.com. GitHub identifies GitHub Advanced Security customers as the audience for this release, limiting the announcement to repositories and accounts covered by that offering.

The preview applies to both organization-owned and personal repositories, but the source does not state that it is available across every GitHub plan or repository configuration. Eligibility remains tied to GitHub Advanced Security and the required code scanning and AI Scan enablement.

GitHub Enterprise Server excluded for now

GitHub Enterprise Server is not supported for this release. The announcement specifically describes the preview as applying to repositories on github.com, so the expansion should not be interpreted as a general rollout across GitHub’s hosted and self-managed environments.

GitHub directs users to its documentation on AI-powered security detections for more information and invites feedback through the GitHub Community. Those resources are presented as the next points of reference for customers evaluating the preview or sharing feedback about the feature.

Sources

• GitHub ChangelogCode scanning AI Scan no longer requires CodeQL default setup