โ—€ Playbook index
NO.19.6

๐Ÿฉบ Code Quality

Updated: 2026-09-11

In a nutshell

Code Quality stops reliability and maintainability problems from becoming tomorrow's technical debt.

It combines CodeQL rules + AI-assisted analysis, suggests fixes in pull requests, measures repository health, and can block merges that miss your quality bar.

What Code Quality covers

Generally available since July 20, 2026. Its job is to keep code reliable, maintainable, and covered by tests as it ages. It is a standalone product that sits next to GitHub Advanced Security, not a feature bundled inside it.

โ–ธ PICK A TOPIC. THE SECOND TAB IS CODE SCANNING, FOR REFERENCE

Primary goal

Primary goal

Keep the code reliable and maintainable: safer refactors, lower maintenance cost, a cleaner codebase.

Catch security vulnerabilities and coding errors before they reach production.

Typical finding

Typical finding

Two families. Reliability: duplicate if condition, unreachable statement, off-by-one against length, missing error check, uninitialized variable. Maintainability: useless assignment, expression with no effect, database query in a loop.

SQL injection, XSS, path traversal, unsafe data flow.

Analysis engine

Analysis engine

CodeQL quality rules, plus AI-assisted detection for patterns no fixed rule covers.

CodeQL security queries, or any third-party tool that uploads SARIF.

Reporting

Reporting

Findings land in two places: bot comments on the pull request, and the repository Security tab for the default branch. Each one is graded Error / Warning / Note, and those grades drive the quality score.

Alerts are graded by severity and CWE, and aggregated in Security overview.

Merge control

Merge control

Quality and coverage thresholds in rulesets, with an evaluate mode to measure the impact before enforcing.

Code scanning checks and security merge protection.

Query coverage

Query coverage

Standard queries: C# 69, Go 22, Java/Kotlin 89, JS/TS 98, Python 101, Ruby 3, Rust 1. 383 in total. C/C++, Swift and Actions are not covered yet.

Default queries: Actions 18, C/C++ 61, C# 59, Go 36, Java/Kotlin 80, JS/TS 89, Python 45, Ruby 44, Rust 36, Swift 29. 497 in total, of which 413 raise alerts.

SELECT A TOPIC โ–ธ

๐Ÿ”‘ Use both: Code Scanning protects against exploitable risk; Code Quality protects long-term code health.

Catch issues before merge

The best time to fix quality debt is while the pull request context is still fresh. In GitHubโ€™s engineering organization, teams resolve 67.3% of Code Quality findings before merge.

  1. Set the bar first โ€” configure a ruleset quality gate so changes below your standard cannot be merged.
  2. Open a PR โ€” it triggers rules-based and AI-assisted analysis, and findings land inline with an explanation and a suggested change.
  3. Resolve โ€” apply the autofix, dismiss with a reason, or delegate broader remediation to Copilot.
  4. The gate holds โ€” the PR stays blocked until the required findings are resolved.
  5. ๐ŸŽ Bonus โ€” fix an alert straight from the Security tab, or open a campaign to work through the backlog in an organized way.

โšก Fixing findings in the PR prevents a second remediation PR and keeps the default-branch backlog clean.

Enable and roll out ๐Ÿ“– Docs

Enablement is a three-level cascade

  • ๐Ÿ›๏ธ Enterprise โ€” Policies โ†’ Code quality allows organizations to use it
  • ๐Ÿข Organization โ€” Settings โ†’ Code quality โ†’ Repository access picks the repositories in scope
  • ๐Ÿ“ฆ Repository โ€” Settings โ†’ Code quality โ†’ Enable code quality turns the scans on

Before you switch it on

  • โš™๏ธ GitHub Actions โ€” deterministic CodeQL scans run as Actions workflows
  • ๐Ÿƒ Runners โ€” GitHub-hosted, or self-hosted with the expected label
  • ๐Ÿงช Coverage โ€” upload Cobertura XML from your existing test workflow
  • ๐Ÿงญ Gates โ€” start rulesets in evaluate mode, then switch to merge blocking

๐Ÿข Rollout can only be checked per organization. The dashboard and โ€œRepository accessโ€ are organization-scoped; the enterprise level only shows the policy allow-list and consumed licenses.

โ–ผ gh-code-quality-inventory.sh Give it an enterprise slug: it walks every organization and reports which repositories have Code Quality enabled ./gh-code-quality-inventory.sh <enterprise>

GA availability and billing

Available on GitHub Enterprise Cloud and GitHub Team.

โ–ธ + UNFOLDS THE DETAIL FOR THAT COST LINE

CostHow it is measuredGood to know
๐Ÿ’บ Base license $10 per active committer / month. Active means a commit was pushed to an enabled repository in the last 90 days.
Product model

Standalone product, complementary to GitHub Advanced Security rather than bundled with it. Not available on GitHub Enterprise Server at GA.

Who counts

A committer is counted once across the organization, regardless of how many repositories are enabled. GitHub App bots are excluded.
๐Ÿค– AI-powered work AI-assisted detection and Copilot-powered features consume GitHub AI credits.
Copilot license

Not required for AI-assisted detection or Autofix. Only the optional delegation of remediation to Copilot needs a Copilot license.

Cap the spend

Set a SKU-level budget: Enterprise โ†’ Budget โ†’ SKU = Code Quality AI credits.
โš™๏ธ Deterministic scans CodeQL workflows consume GitHub Actions minutes, unless self-hosted runners are used.
Cap the spend

Set a GitHub Actions budget, or move the scans onto self-hosted runners.

Measure quality over time

Pull-request enforcement stops new debt. Dashboards and APIs tell you where the existing debt already lives.

  • ๐Ÿ“Š Repository and organization dashboards โ€” reliability and maintainability scores across repositories, so you can see which ones carry the most debt
  • ๐Ÿงช Coverage on pull requests โ€” render existing Cobertura XML reports and show whether coverage improves or drops
  • ๐Ÿ”Œ APIs โ€” manage repository enablement and retrieve findings for your own reporting

๐ŸŽฏ Dashboards tell you where quality debt lives; rulesets stop teams from adding more.