GitHub AI Scan for pull requests generally available
At a glance
AI Scan is GA: it complements CodeQL by auto-scanning PR diffs for languages/frameworks CodeQL does not cover (PHP, Shell, Terraform HCL, Dockerfiles, JSP, Blazor, etc.), surfaces advisory findings with explanations and suggested autofix, and consumes Code Security AI Credits without blocking merges. This workflow is listed under security, code-review, pr-agents, github, learnable-paradigm.
Agents / tools
GitHub AI Scan, CodeQL, Copilot Autofix, code scanning
Assign default-branch CodeQL/code-scanning alerts to Copilot: the agent explores the codebase, proposes a fix, reruns CodeQL to validate, iterates if needed, then opens a draft PR—batch up to 25 alerts or assign via REST with assignees ["copilot-swe-agent[bot]"].
Anthropic’s Claude Code team documents a layered review stack—pre-PR verify, AI review + security block, risk-tiered human approvals, merge queue/flags, and fast rollback—so most agent PRs merge with ≤1 human while revert rate fell >40% as volume doubled.
Bitbucket Cloud pattern for large monorepos: a matcher agent maps changed paths to the right review docs via Bitbucket MCP, then a fresh reviewer comments only against that short list—humans still approve.
Self Labs’ Agent Vault gives agents mock tokens for checkout and sign-in; real card numbers and passwords never reach the model. Caps, merchant allowlists, and per-purchase approval. Connect Grok Bot via MCP or Meta Muse via custom connector in ~2 minutes (also Claude Code, Hermes, Codex).