What changed
GitHub moved AI Scan for pull requests to general availability. It runs alongside CodeQL on eligible pull requests and covers additional languages and formats, but its findings remain advisory: they cannot fail the code-scanning check or block merges, and scans skip fork and Dependabot pull requests.
Why it matters
The availability boundary is broader and production-ready, but the enforcement boundary is deliberately weak. Security teams can add model-based review across more stacks without mistaking the result for a merge gate or complete static analysis.
What to do
Enable AI Scan on a representative repository, seed vulnerable and benign changes across covered languages, compare findings with CodeQL and manual review, budget AI Credits, and keep blocking rules tied to validated controls rather than advisory AI output.
Caveat
General availability does not establish accuracy or completeness. Findings cannot block merges, fork and Dependabot pull requests are excluded, private repositories require GitHub Code Security or Advanced Security, and scans consume Code Security AI Credits.