GitHub's AI Scan Now Checks PHP, Bash and Terraform PRs. It Can't Block a Merge Yet

• Book: Decoupled PHP — Clean and Hexagonal Architecture for Applications That Outlive the Framework
• Also by me: Thinking in Go (2-book series) — Complete Guide to Go Programming + Hexagonal Architecture in Go
• My project: Hermes IDE | GitHub — an IDE for developers who ship with Claude Code and other AI coding tools
• Me: xgabriel.com | GitHub

On October 15, 2026, GitHub made AI Scan for pull requests generally available, and its headline is coverage CodeQL doesn't have: "PHP, Shell/Bash, Terraform configuration (HCL), Dockerfiles, JSP for Java, Blazor for C#, and more." A pull request that touches a PHP controller, a deploy script and a Terraform module now gets a security read on all three files.

The same day, GitHub made agentic autofix for code scanning alerts generally available. It hands an alert to Copilot's coding agent, which writes the fix and opens a draft pull request.

Neither headline mentions the limits or the meter.

What went GA on October 15

AI Scan runs on pull requests and reports vulnerabilities in the changed code. Per the changelog, findings show up next to CodeQL results on the Conversation and Files changed tabs, marked "AI," and can carry an explanation and a suggested fix.

The idea isn't new. GitHub announced AI-powered detections in March, saying internal testing processed more than 170,000 findings in 30 days. heise covered the same plan at the time. The feature entered public preview on July 14 with a Copilot license required, and stopped requiring CodeQL default setup on September 16.

What changed with GA is access. AI Scan "is available for public repositories owned by organizations or personal accounts," and "a GitHub Copilot license is not required," per the changelog. Private and internal organization repos still need GitHub Code Security or GitHub Advanced Security.

AI Scan reads the changed files CodeQL never covered: scripts, containers, infrastructure and PHP.

What AI Scan looks for, and what it won't do

The docs list the categories: string injection, weak cryptography, broken access control, sensitive data exposure, security misconfiguration, authentication failures, data integrity failures, SSRF and supply chain risks. It scans when a PR opens and after each new commit, and it works without a build system.

In PHP, the classic shape of string injection looks like this:

<?php
// User input concatenated straight into SQL
$id = $_GET['id'];
$rows = $pdo->query("SELECT * FROM users WHERE id = $id");

// Parameterized: the driver sends the value separately
$stmt = $pdo->prepare('SELECT * FROM users WHERE id = ?');
$stmt->execute([$_GET['id']]);
$rows = $stmt->fetchAll();

That is the class of bug the docs name. Whether AI Scan flags a given line in your code is up to the model, and the docs warn that "AI Scan findings may include false positives."

The same docs page lists the limits:

• "Findings are advisory." They don't fail the code scanning check, and they "cannot yet be used in rulesets to enforce merge requirements."
• Pull requests from forks and pull requests opened by Dependabot are not scanned.
• It scans pull requests only. Full repository scans aren't supported, so the PHP you merged last year stays unread until someone changes it.
• It ignores your copilot-instructions.md or CLAUDE.md and uses its own prompts.

The fork rule matters most for open source. On a public project, outside contributors usually open pull requests from a fork, and those PRs get no AI Scan at all. Keep whatever blocking checks you run today. Treat AI Scan findings as review comments, and leave the merge gate to the checks you already require.

Public repos: no license, but not free

"No Copilot license required" is easy to read as "free." GitHub's billing docs say otherwise: AI Scan and agentic autofix consume the Code Security AI Credits SKU, "even when the repository is public."

One AI credit is $0.01. If your billing account has a Copilot plan, AI Scan draws from its included credits first: Copilot Business includes 1,900 credits per user per month and Copilot Enterprise 3,900, pooled at the billing entity. Once that allowance runs out, usage is metered. If your account has no Copilot seats, there are no included credits and all usage is metered. Neither the changelog nor the docs say how many credits one PR scan uses.

Two details from the AI Scan docs are worth knowing before anyone flips the switch:

1. Turning it on at the organization level applies to every eligible repo at once, and qualifying PRs can consume credits before a repo admin opts out.
2. If a hard budget leaves no credits, scanning stops until an admin raises the budget or a new billing cycle starts.

The billing docs recommend setting budgets before security admins enable AI Scan or agentic autofix broadly. Do it in that order.

Agentic autofix replaces the free Generate Fix button

The second GA is the bigger workflow change. Per the changelog, when enabled, agentic autofix "replaces the free Generate Fix option on individual code scanning alerts with an Assign to Copilot button."

Assigned, the agent explores the codebase beyond the affected file, proposes a fix, re-runs CodeQL to confirm the alert closes, and opens a draft PR with a summary and its validation steps. You can select "up to 25 alerts for Copilot to fix together in a single pull request." It works only on alerts from the default branch.

Up to 25 alerts go to the agent at once and come back as one draft pull request for a human to review.

You can also assign alerts from a script. The changelog points to the Update a code scanning alert endpoint with assignees set to ["copilot-swe-agent[bot]"]. With the GitHub CLI:

gh api -X PATCH \
  repos/OWNER/REPO/code-scanning/alerts/42 \
  -f 'assignees[]=copilot-swe-agent[bot]'

I haven't run that against a live repo, so check the alert number and your org policy first.

The cost model is different from the button it replaces. "Agentic autofix for code scanning alerts consumes AI Credits from your Code Security budget and GitHub Actions minutes," the changelog says. The classic Copilot Autofix suggestion "does not consume AI credits".

The autofix docs add the fine print. Agentic autofix "works on a best-effort basis." Its validation re-runs CodeQL with the default code scanning query suite, so it "can't confirm fixes for alerts from custom CodeQL queries," nor for security-extended or third-party tool alerts. A green draft PR from the agent proves the alert it was checked against closed. It doesn't prove the change is right.

What to do this week

You won't know what a scan costs until you run one, so start small. Set a Code Security AI credits budget, then enable AI Scan on one repo that has PHP, shell or Terraform in it and watch what it draws before you widen it.

Decide who owns that budget, too. Without one, scans keep running on metered credits nobody approved. Under a hard budget with no owner, scanning stops mid-month and nobody notices.

When the agent opens a fix PR, read the diff and run your tests as you would for any other PR. Its validation only covers the default code scanning query suite.

If you maintain a public repo, is an advisory finding that skips fork PRs worth the credits to you?

If this was useful

AI Scan's first headline language is PHP, and string injection, user input reaching a query, is the first category on its list. That bug is far easier to review when every SQL call in your app lives behind one adapter instead of being spread across controllers. Decoupled PHP is my book on structuring PHP apps that way, with the framework and the database kept at the edge. And if you run several coding agents and review what they write, I build Hermes IDE (GitHub), free and source-available on macOS, Windows and Linux, so weigh the plug with that in mind.

Available on Kindle, Paperback, and Hardcover. English, German, and Japanese editions out now — Portuguese and Spanish coming soon.