GitHub AI Scan Can Review PHP—Can It Block a Pull Request?
AI Scan now flags security issues in the PHP changes CodeQL never covered. What happens when it finds one on a pull request your ruleset protects?
- AI Scan is generally available for PR changes in PHP and other areas CodeQL does not cover.
- Findings do not fail the code scanning check or enforce ruleset merge requirements.
- Fork and Dependabot PRs are excluded; public repositories also consume AI credits.
PHP coverage does not add a merge gate
GitHub AI Scan can flag vulnerabilities in PHP changes, but those findings cannot block a PR through ruleset requirements. The October 15 general release complements CodeQL with coverage including PHP, Shell/Bash, HCL, Dockerfiles, JSP and Blazor.
CodeQL itself does not support PHP. AI Scan adds findings marked “AI” on the PR's Conversation and Files changed tabs. They can explain a security risk and suggest a fix, but they remain advisory and do not fail the code scanning check. Keep required checks and approval rules in place if your process depends on enforced review.
Enable code scanning and the effective AI Scan setting
AI Scan requires code scanning and an enabled AI Scan setting. It does not require CodeQL default setup or a successful CodeQL run.
For organizations, an owner or security manager enables it through global security settings. Eligible repositories inherit the setting, and repository administrators can opt out. An enterprise must first permit the feature; enterprise permission alone does not enable it for organizations.
Public repositories owned by ordinary personal accounts or organizations are eligible. Private and internal organization repositories need Code Security or Advanced Security. Personal private repositories and managed users' personal namespaces are excluded. Administrators of ordinary personal public repositories control the toggle under Code scanning directly.
Fork contributions are outside the current scope
The documented trigger is a qualifying PR's creation or new commits. PRs from forks and PRs created by Dependabot are excluded. For a project built around fork contributions, enabling the repository feature therefore leaves an important part of its incoming changes outside this scan.
AI Scan also does not scan the full repository or create a backlog of findings in its security view. When results are absent, check the PR's origin, supported changes, effective settings and available credits before interpreting the empty result.
No Copilot license requirement does not mean free scanning
A Copilot license is unnecessary, but Code Security AI Credits apply even to public repositories. Included credits on the billing account are used first; subsequent usage is metered. Without an included allowance, usage is metered from the start.
Organization repository usage goes to the account paying that organization's bills. Before enabling broadly, review its allowance and budget: a hard limit that leaves no credits available prevents AI Scan from producing findings. Define which PRs it covers, who reviews its findings and how much usage the account permits.