Viewing and managing AI Scan alerts on your repository''s default branch

Run an AI Scan, review the alerts in your code scanning backlog, and check fixes for security vulnerabilities.

Who can use this feature?

Users with write access

In this article

Note

AI Scan for repositories is in public preview and subject to change.

Prerequisites

AI Scan for repositories must be enabled for your repository. See AI Scan for a repository's backlog.

Running a scan

Scans analyze your repository's default branch.

  1. On GitHub, navigate to the main page of the repository.
  2. Under the repository name, click the Security and quality tab. If you cannot see the " Security and quality" tab, select the dropdown menu, and then click Security and quality.
  3. In the left sidebar, click Code scanning.
  4. In the top right corner, select the AI Scan dropdown.
  5. From the dropdown, to the right of Standard scan, click to start the scan.
  6. Wait for the scan to complete.

Viewing AI Scan alerts

When the scan finishes, its findings appear in the code scanning alert list. Filter the list by the AI Scan tool to review them.

Use the existing alert assessment and remediation workflows:

Checking fixes and closing alerts

After a potential fix is merged into the default branch, repeat the steps in Running a scan. Merging a fix does not automatically trigger another AI Scan.

During public preview, an alert only closes automatically after a new scan if the fix changes the exact line of code that triggered the alert. Otherwise, you must manually close the alert.