💡 AI-Powered Code Scanning Fleet Enablement & Triage Standard

[github-actions[bot]]

Summary

GitHub shipped AI-powered security detections on pull requests (July 14, 2026), extending vulnerability coverage to languages and frameworks not currently supported by CodeQL. This proposal creates an org-wide standard for enabling these AI detections across all repos, defining triage severity mapping between AI and CodeQL findings, and establishing a review workflow that integrates AI detections with the existing CodeRabbit + Copilot + CodeQL review pipeline.

Market Signal

GitHub shipped "Code scanning shows AI security detections on pull requests" on July 14, 2026. This extends GitHub Advanced Security beyond CodeQL's deterministic analysis to AI-powered pattern detection. The AI code review market is splitting into pure LLM reviewers (CodeRabbit, Copilot Code Review) and verification platforms (SonarQube + AI, Qodo 2.0) — GitHub is bridging the gap by adding AI detections alongside CodeQL SAST. Competitors like Qodo 2.0 (60.1% F1 score) and Greptile (82% bug catch rate) demonstrate strong market demand for AI-augmented security detection.

User Signal

• The org already requires CodeQL as a CI gate (Analyze on broodly, Analyze(Python) on TalkTerm)
• SonarCloud is required on markets and ContentTwin, but language coverage gaps exist
• Recent SonarCloud debt reduction initiative (Initiative: SonarCloud org-wide debt reduction & rule tuning #593) and dependency hardening work (SonarCloud: GitHub Actions / dependency hardening (×13) #598, SonarCloud: resolve remaining S7635 secrets-inherit stubs (×18) #600, SonarCloud: GitHub Actions / dependency hardening #623) show active investment in expanding security coverage
• AI detections fill the gap between CodeQL's deterministic rules and full-spectrum vulnerability detection

Technical Opportunity

The org's CI standards (ci-standards.md) already mandate CodeQL and SonarCloud. AI detections use the same SARIF integration and code scanning dashboard — no new infrastructure needed. The existing agent-shield and pr-auto-review pipelines provide the triage layer. Enabling AI detections is a repository setting change, deployable fleet-wide via apply-repo-settings.sh.

Assessment

Dimension	Score	Rationale
Feasibility	high	Repository setting change; uses existing SARIF infrastructure
Impact	high	Extends vulnerability coverage to languages CodeQL misses
Urgency	high	Feature shipped July 14, 2026 — early adoption captures maximum value

Adversarial Review

Strongest objection: AI security detections may generate false positives that add noise to the PR review process, slowing developer velocity. The feature is only days old and signal quality is unproven at scale.

Rebuttal: The org can enable AI detections in audit mode first (non-blocking), evaluate signal-to-noise ratio over 2–4 weeks, then promote to a required check. This mirrors the evaluate-then-enforce pattern already used for rulesets and workflow execution protections. The existing CodeRabbit + Copilot review pipeline already handles AI-generated feedback — AI detections are additive coverage, not a replacement.

Suggested Next Step

Enable AI security detections in audit mode on petry-projects/.github as a pilot. Track false positive rate over 2 weeks. If signal quality is acceptable, add to ci-standards.md as a recommended check and roll out fleet-wide via apply-repo-settings.sh.