On November 13, 2026, GitHub announced public-preview REST API controls for AI Scan for repositories. Organizations and repositories can now manage the repository_scan setting through the existing AI Scan enablement endpoints, making a controlled rollout possible through scripts or infrastructure as code. For QA engineers, that makes the configuration contract—not merely the scan result—the first thing to validate.
What changed in GitHub AI Scan
GitHub added repository_scan to the organization and repository AI Scan endpoints: GET and PATCH /orgs/{org}/code-scanning/ai-scan, plus GET and PATCH /repos/{owner}/{repo}/code-scanning/ai-scan. An enabled organization setting is inherited by repositories, which may opt out; a disabled organization setting prevents repositories from opting in. If enterprise policy disallows AI Scan, an enable request returns 422.
GitHub also says that pr_scan and repository_scan can be updated together. If either requested change is blocked, the API returns 422 and neither setting changes. Enabling repository scan does not itself run a scan: a writer still starts one on demand, and each scan consumes GitHub Code Security AI credits.
Why this matters for QA engineers
A scriptable security control can reach many repositories quickly, including the wrong ones if inheritance, permissions, and error handling are assumed rather than tested. Treat this as a configuration rollout with observable state transitions. The proof should include the policy decision, the resulting effective setting at each scope, the expected denial paths, and separately recorded evidence for any on-demand scans and their credit use.
A practical QA checklist
- Scope and inheritance: In a disposable organization, enable
repository_scanat the organization level and verify a child repository inherits it. Then opt one repository out and prove its sibling remains enabled. - Parent deny: Disable the organization setting, attempt a repository-level enable, and confirm the request is rejected with no effective change.
- Enterprise-policy denial: Where a test enterprise policy is available, disallow AI Scan and assert that enablement returns the documented
422. Capture the response and re-read the setting afterward. - Atomic paired updates: Send one permitted and one deliberately blocked change for
pr_scanandrepository_scan. Verify that neither value changes, then test a valid paired update. - Authorization boundaries: Test an organization owner or security-manager path separately from a repository administrator path. Confirm repository administrators can opt out only within the limits GitHub documents.
- Enablement is not execution: After enabling the setting, verify that no scan is implicitly started. Run a controlled on-demand scan with a write-authorized test user and record the evidence independently.
- Credit and rollback evidence: Before broader rollout, define an approved credit budget, log every intentional test scan, and rehearse restoring the prior configuration from a saved scope-by-scope baseline.
A minimal API contract scenario
Given an organization policy permits AI Scan
And repository A inherits the organization setting
When automation enables repository_scan for the organization
Then a read of repository A shows the expected effective state
When repository A opts out
Then repository A is disabled and repository B remains enabled
When policy blocks one setting in a paired PATCH
Then the API returns 422
And a follow-up GET proves neither requested setting changedRoll out deliberately
Start with a small, representative set of repositories and preserve a baseline export of effective settings. Keep configuration validation separate from scan-quality evaluation: a correct API rollout does not establish that every finding is useful, and an enabled setting does not trigger a scan. Add clear approval, audit, and rollback points before expanding the script to more organizations.
Bottom line
GitHub’s REST API support gives teams a repeatable way to manage AI Scan for repository backlogs. The safest QA approach is to test inheritance, denials, atomic behavior, authorization, and post-change reads first—then test the separately initiated scans and their credit impact.
Source
GitHub Changelog: Manage AI Scan for repositories using the REST API (November 13, 2026)