GitHub Code Quality Pricing: A Pre-GA Rollout Checklist

GitHub Code Quality is scheduled to move from public preview to general availability on July 20, 2026. GitHub says the product will cost $10 per active committer per month for repositories where Code Quality is enabled. That headline price is only one part of a rollout estimate: GitHub Actions usage and AI-powered usage are billed separately, and repository selection determines which committers enter the license calculation.

GitHub documents the date, list price, license-estimate view, eligibility, and billing model in the official sources linked below. The planning workflow in this article is inferred operational guidance, not a GitHub requirement. CodeRiskTools did not test GitHub’s production billing system, validate the estimate against an invoice, or measure Code Quality detection accuracy. Confirm current terms and your account’s estimate before enabling a paid feature.

What changes on July 20, 2026

According to GitHub’s June 16 announcement, Code Quality becomes a separately purchasable product on July 20. GitHub documents availability for GitHub Team and GitHub Enterprise Cloud, but not GitHub Enterprise Server. The preview announcement also notes that scans use GitHub Actions minutes; the GA announcement says Actions and AI-powered usage remain separate from the $10 active-committer charge.

The new public-preview license estimate gives organization owners a forward-looking view before GA. GitHub says it uses active committers from the preceding 90 days for repositories where Code Quality is enabled. An estimate is useful for planning, but it is not an invoice or a permanent ceiling: repository scope and contributor activity can change.

Build a cost model that does not stop at $10

A simple scenario should show a low, expected, and high repository scope. For example, use the current GitHub estimate as the expected case, then model bounded changes in active committers and scan frequency. Label every number by source and date. Do not convert an unverified contributor count from HR, Git logs, or another GitHub security product into a Code Quality license claim.

Reconcile the active-committer denominator

The denominator deserves more attention than the multiplication. Export or record the estimate, then map each enabled repository to its owner, business purpose, archive status, recent contributor set, and intended rollout wave. Look for mirrors, generated repositories, temporary migrations, and repositories enabled only for a pilot. The goal is not to remove legitimate contributors; it is to ensure paid scope matches an explicit repository decision.

• Record the organization and repository set visible in the estimate.
• Capture the estimate timestamp and the stated 90-day lookback.
• Identify repositories that should be out of scope before GA, with an owner-approved reason.
• Keep public forks, archived projects, and mirrored repositories in separate review rows.
• Recalculate after any enablement change rather than assuming an immediate or specific billing effect.
• Preserve screenshots or exports in access-controlled financial evidence, without tokens or private source content.

A seven-step pre-GA rollout workflow

1. Freeze the baseline. Record current organization settings, enabled repositories, plan, estimate, Actions consumption, and the date of collection.
2. Name an owner. Assign one technical owner for repository scope and one billing owner for price and invoice reconciliation.
3. Select a bounded pilot. Choose repositories with representative languages and review volume, but avoid enabling the entire organization merely to test the interface.
4. Define acceptance evidence. Track completed analyses, actionable findings, dismissed findings with reasons, workflow duration, queue latency, and reviewer effort. Do not call a clean run proof of secure code.
5. Run the pilot before GA. Use the preview window to observe workflow behavior and the displayed estimate. Bind observations to repository names, commits, and dates.
6. Make an explicit July 20 decision. Keep, narrow, expand, or disable scope based on verified utility and expected cost. Preserve the pre-change state so the decision is reversible.
7. Reconcile the first bill. Compare the invoice, enabled scope, active-committer evidence, Actions usage, and AI usage. Investigate differences instead of forcing the estimate to equal the charge.

Keep code-quality findings in the merge workflow

A commercial rollout succeeds only if findings reach the people who can evaluate them. Document which branches trigger analysis, whether pull requests display results, who owns triage, and what happens when analysis fails or times out. GitHub’s enabling guide should be the authority for current setup steps; local documentation should link to it rather than copying a configuration that can become stale.

Code quality and security review also have different scopes. A maintainability finding does not replace secret scanning for AI-generated code, security-query validation, dependency review, access control, or an exact-change merge workflow. If a pull request changes CI permissions, authentication, or a sensitive data flow, review that intent even when quality checks pass.

Pre-purchase verification checklist

• The current GitHub estimate was captured by an authorized organization owner.
• Every enabled repository has a named owner and documented reason for inclusion.
• The $10 figure is labelled as GitHub’s documented list price for GA, not a guaranteed invoice.
• Actions and AI-powered usage are represented as separate cost lines.
• The pilot records workflow duration and reviewer effort as well as finding counts.
• Failed, skipped, and timed-out analyses are not counted as clean results.
• Rollout scope can be reversed without deleting repositories or evidence.
• The first post-GA invoice has an assigned reconciliation date and owner.

FAQ

Is GitHub Code Quality free after July 20?

GitHub says no: it becomes a paid product at $10 per active committer per month. Check the live billing documentation and your organization’s account before purchase because terms can change.

Does the license include GitHub Actions usage?

GitHub’s GA announcement says Actions and AI-powered usage are billed separately. Model them independently and verify the applicable plan, runners, and current pricing.

Is every person with repository access an active committer?

Do not substitute access lists for the product’s estimate. GitHub says the estimate uses active committers over the preceding 90 days for repositories with Code Quality enabled.

Does a Code Quality pass prove a pull request is secure?

No. It is one review signal. Security-sensitive changes still need threat-aware code review, appropriate security tools, and validation against the exact final diff.

Official sources and next step

• GitHub Changelog: Code Quality generally available July 20, 2026 — vendor announcement for GA timing, list price, availability, and separate usage charges.
• GitHub Changelog: Code Quality license estimate in public preview — vendor description of the estimate and 90-day active-committer view.
• GitHub Docs: about Code Quality — current product scope, eligibility, and workflow documentation.
• GitHub Docs: enabling Code Quality — current setup and repository enablement instructions.
• GitHub Docs: Code Quality billing — current billing concepts and controls.

Use the single CodeRiskTools comparison hub to separate workflow scope without turning feature lists into security guarantees.