AI Scan’s existing Security Overview Coverage view now includes pull-request status. UI: enabled/not enabled; CSV: enabled/not-enabled. Coverage shows effective repo state after policy/settings; not-enabled rows may be ineligible, with no reason. See the October 6 changelog and adoption guide.
What the preview exposes
The September 10 preview adds GET and PATCH controls at /orgs/{org}/code-scanning/ai-scan and /repos/{owner}/{repo}/code-scanning/ai-scan. A repository cannot override an organization-level disabled setting. The preview is on GitHub.com for GitHub Advanced Security customers; GitHub Enterprise Server is unsupported for this release. See the API announcement.
Update older setup notes: on September 16, GitHub removed CodeQL default setup as an AI Scan prerequisite. The dated change documents the correction.
Code scanning and the effective AI Scan setting still matter; a waiting or failed CodeQL analysis does not stop AI Scan. Current AI Scan docs describe its independent trigger.
Use the existing Coverage view to audit AI Scan status
- Save the view level, selected team or repository filters, and export time so a later snapshot uses the same scope.
- Click an enabled or not enabled count to filter repository rows, or use
code-scanning-ai-scan-pr-scan:enabledandcode-scanning-ai-scan-pr-scan:not-enabled. These AI Scan filters were added to Coverage. - Export the Coverage CSV and retain its
Code Scanning AI Scan for pull requestscolumn. Its values areenabledandnot-enabled. The changelog lists the new column. - Compare intended repositories. Not enabled may include ineligible repos without a reason; investigate before changing settings. See the adoption guide.
For trend checks, compare like-scoped snapshots on the same reporting cadence.
Read and update the settings
GET first. Org GET is stored state; enterprise policy applies. PATCH bodies below are illustrative, unexecuted. See REST docs.
{"pr_scan":"enabled"}
{"pr_scan":"disabled"}Permissions are different for read and update
GitHub App user/install tokens and fine-grained personal access tokens work; see operation scopes in REST permissions.
| Operation | Classic token scope | Fine-grained permission |
|---|---|---|
| Org GET | admin:org or repo (owner); write:org (security manager) | Organization Administration: read |
| Org PATCH | Same role scopes as GET | Organization Administration: write; policy allows AI Scan |
| Repo GET | security_events private/public; public_repo public only | Code scanning alerts: read |
| Repo PATCH | repo private/public; public_repo public only | Repository Administration: write |
Prerequisites before a pilot
AI Scan requires GitHub Advanced Security and GitHub Copilot licenses plus AI credits. It triggers on pull-request creation and new commits when code scanning and effective AI Scan are enabled and an eligible PR has qualifying changes in a supported language/framework CodeQL does not cover. See AI Scan docs.
AI Scan covers pull requests only; it does not run on fork or Dependabot pull requests. Language and framework support may change during preview. See current exclusions.
What this does not prove
Enabled status proves configuration, not a scan or detection quality. Findings appear on pull requests, not backlog alerts; they are advisory, cannot enforce merge requirements, and may be false positives. Keep existing checks and human review. See the limitations.
Failure modes and rollback
403: permission, Advanced Security, or archived repository; 404: missing; 422: invalid/spam. See REST docs.
Roll back: PATCH the prior pr_scan value to the same route; retain approval and request history. See REST docs.
Record a reversible pilot
- Choose one eligible, non-critical repository. Save the Coverage export with its date, team or repository filters, and organization scope.
- GET both levels; check policy, licenses, credits, eligibility.
- Get owner approval for one least-privilege PATCH; record the prior value for rollback.
- Review AI findings with human checks; enabled status proves configuration only.
For the adjacent governance decisions, use the Copilot model and budget review guide. The Copilot VS Code release guide covers the separate editor feature surface.
FAQ: questions readers ask
Why could org GET and CSV status differ?
Hypothetical, not observed: org GET may be enabled while CSV is not-enabled: stored org setting versus effective repo status. Check policy, repo setting/opt-out, Code Scanning, and eligibility; don’t auto-PATCH. See REST docs and adoption guide.
