GitHub paywalls Shell, Docker, Terraform scans; free action fills gap

By Meridian48 News Desk · Summarised from DEV Community · July 27, 2026

GitHub's July 14 update added AI-powered code scanning for Shell, Dockerfiles, Terraform, and PHP, but only for paying Advanced Security customers. A developer created a free GitHub Action that runs open-source scanners (ShellCheck, Hadolint, tfsec, PHPStan) and uploads results to the Security tab. The action covers the same ecosystems that free CodeQL never supported.

Meridian48 take

This is a clever workaround that highlights how GitHub is slowly pushing more security features behind a paywall, but it relies on deterministic tools, not the AI detections that GitHub is selling.

Read the full reporting

GitHub put Shell, Dockerfiles, Terraform and PHP behind a paywall. Here's a free Action that scans them. →

DEV Community

githubcode-scanning

GitHub paywalls Shell, Docker, Terraform scans; free action fills gap

How EdgeVPN builds a serverless VPN with Go and TUN devices

mise and Ota Combine for Repo Tooling and Acceptance

Tiny Interpreters Blog Teaches Programming Languages One Step at a Time