GitHub's AI Scan reads the files CodeQL skips, but it can't block a merge and a spent budget looks like a clean scan

Mon, 19 Oct 2026 16:04:00 +0000

Ask a coding agent to containerise a service, add a bucket and ship a deploy script, and most of what comes back isn’t C#, TypeScript or Python. It’s a Dockerfile, some Terraform and a Bash script. Those are the files CodeQL doesn’t analyse, and GitHub now has something that does look at them in pull requests: AI Scan, generally available since 15 October 2026.

Agentic autofix is generally available: what the CodeQL re-run proves, and what it doesn't

Thu, 15 Oct 2026 16:05:00 +0000

Assigning a code scanning alert to Copilot now ends in a draft pull request that says CodeQL was re-run and the alert closed. That sentence is true, and it is narrower than it sounds. Agentic autofix reached general availability on 15 October 2026, so it’s worth knowing exactly what the check covers before a reviewer starts waving these PRs through.

Code-Scanning on Tokenise

GitHub's AI Scan reads the files CodeQL skips, but it can't block a merge and a spent budget looks like a clean scan

Agentic autofix is generally available: what the CodeQL re-run proves, and what it doesn't