GitHub AI Scan reportedly no longer requires CodeQL default setup
A user says code scanning and AI Scan must still be enabled, and findings remain informational: they appear only on pull requests and do not block merges on their own.
TLDR
A user reports that GitHub removed AI Scan’s CodeQL default-setup requirement on September 16, 2026. Organizations that already enabled AI Scan can get pull request findings in eligible repositories without that extra setup, including for languages CodeQL does not cover, such as PHP, HCL and Dockerfiles. Code scanning and AI Scan must still be enabled. The user describes the feature as a public preview for Advanced Security on GitHub.com, excluding GitHub Enterprise Server. Findings remain labeled AI and do not block merges on their own.
Combined views
10
1 Source, first seen ago