GitHub Code Quality is now generally available on GitHub Enterprise Cloud and GitHub Team. The July 20, 2026 GitHub Changelog announcement describes a standalone paid product built around deterministic CodeQL analysis, AI-assisted detection, pull-request quality signals, and Copilot Autofix. It also changes the operator question: instead of asking whether to try the preview, teams need to verify where Code Quality is enabled, what billing inputs apply, and whether new gates match their release process.
This is a practical reconciliation checklist, not a billing or detection guarantee. The availability, feature, and pricing statements below are documented by GitHub. The ordering and evidence table are recommended operational guidance inferred from those published controls. CodeRiskTools did not test GitHub billing, CodeQL accuracy, Copilot Autofix, or your organization settings.
What changed at general availability
GitHub says Code Quality now supports organization-wide enablement, organization dashboards for maintainability and reliability scores, Cobertura XML coverage metrics in pull requests, quality gates through rulesets, an evaluate mode for gradual rollout, and APIs for managing repository enablement and fetching findings. It is complementary to GitHub Advanced Security rather than bundled into it, and GitHub Enterprise Server is not listed as available at launch.
The practical implication is that a preview configuration can become a production governance input without a new migration project. Before treating a green dashboard or a passing rule as evidence of improved security, record the exact repositories, ruleset mode, scan workflow, coverage source, and finding disposition process.
Start with a scope and entitlement snapshot
| Check | Record | Why it matters |
|---|---|---|
| Platform | Enterprise Cloud, Team, or another environment | GitHub documents availability by product and says Enterprise Server is not available at launch. |
| Enabled repositories | Repository names, owners, default branches, and enablement date | Billing and operational coverage depend on actual repository scope. |
| Active committers | Organization estimate capture date and repository scope | GitHub defines an active committer using pushes in the preceding 90 days and counts each person once across the organization. |
| Automation identities | Bot accounts and service accounts reviewed separately | GitHub states bot accounts are not charged; retain the evidence for your reconciliation. |
| Workflow and runner | Actions workflow, trigger, runner type, duration, and frequency | Deterministic analysis has separate compute costs, including on GitHub-hosted and self-hosted runners. |
Build the billing review from separate cost lines
GitHub documents a base price of $10 per active committer per month. That is not a complete operating-cost estimate. The announcement separately identifies usage-based billing for AI-powered work and compute costs for deterministic CodeQL analysis through GitHub Actions. Do not combine those lines into a single “included” figure unless your current agreement explicitly says so.
- Export or capture the current Code Quality estimate and the repositories included in it.
- Reconcile active people once at organization level; do not multiply the same committer by every enabled repository.
- List AI-assisted detection and Autofix usage separately from deterministic analysis.
- Record hosted versus self-hosted runner usage, expected scan frequency, and any workflow concurrency changes.
- Save the capture timestamp and agreement or pricing page used for the review.
The result should be a dated planning record, not an invoice prediction. Repository scope, contributor activity, scan frequency, and enabled AI features can change after the snapshot.
Roll out quality gates without surprising developers
Rulesets can enforce quality gates, but immediate enforcement is not always the safest first move. Use the documented evaluate mode to observe results while you classify false positives, missing coverage, remediation ownership, and exceptional repositories. Define who can change a threshold, what evidence is required for an exception, and when an evaluation finding becomes a blocking check.
Coverage deserves its own verification. GitHub says Code Quality can render metrics from existing Cobertura XML test reports. Confirm that the report is generated for the intended commit, uploaded by the intended job, and not silently replaced by a stale artifact. A displayed percentage is a metric from a report; it is not proof that the tests exercise the risk-relevant paths.
If you used the public preview
GitHub states that preview users do not need to migrate or reconfigure: Code Quality keeps running under the existing GitHub agreement, now as a paid product. That convenience makes a post-GA inventory more important, not less. Review every enabled repository, the current ruleset mode, the active-committer estimate, and the workflows that invoke analysis.
If a repository should no longer run Code Quality, use GitHub’s documented disable path and verify the resulting state through the repository or organization interface/API. Keep a before-and-after record. Never infer that removing a workflow file alone disables an organization-level entitlement or stops every related charge.
Evidence to keep for the next review
- Official announcement and current GitHub Code Quality documentation.
- Enabled-repository export and active-committer estimate with capture time.
- Ruleset configuration, evaluate/enforce state, threshold changes, and exception record.
- Workflow run links, runner class, scan frequency, and representative Cobertura report provenance.
- Separate AI usage, Actions compute, and base-license planning lines.
For a broader local change-review workflow, compare the available AI Change Firewall options. It is a separate local workflow and does not replace GitHub’s Code Quality service, CodeQL, or your organization’s billing controls. You can also use the existing pre-GA pricing checklist as historical planning context; this article is the post-GA verification step.
FAQ
Is Code Quality included with GitHub Advanced Security?
GitHub’s GA announcement describes Code Quality as a standalone paid product complementary to GitHub Advanced Security. Confirm current commercial terms for your account before purchase or renewal decisions.
Does $10 per active committer include AI and Actions usage?
GitHub lists AI-powered usage and GitHub Actions compute as separate metered components. Keep them as separate lines in your review.
Does a passing quality gate prove the code is secure?
No. A gate reports the configured checks and thresholds. It does not prove complete coverage, absence of vulnerabilities, or safe deployment.
Source note: GitHub Changelog, “GitHub Code Quality is now generally available,” published July 20, 2026: official announcement. Product behavior and pricing can change; verify the current GitHub documentation and account terms.
