github code quality goes GA at $10/committer — codeql meets copilot autofix

GitHub Code Quality went generally available on July 20, 2026 on GitHub Enterprise Cloud and GitHub Team. the pricing is $10 per active committer per month on enabled repositories, plus usage-based consumption for AI-powered features: Copilot code review, AI-assisted detection, and Copilot Autofix. CodeQL's deterministic analysis still runs on GitHub Actions minutes, which you're already consuming.

10,000+ enterprises used the public preview. it is no longer free.

two analysis modes, one product

Code Quality ships two complementary detection layers. CodeQL is the deterministic half: a static analysis engine that queries your codebase's semantic model for known patterns — null dereferences, injection vectors, type mismatches, dead code branches. it is deterministic, auditable, and produces no false negatives for the patterns it covers.

the AI-assisted detection layer handles what CodeQL cannot express in a query: maintainability smells, architectural drift, and reliability patterns that require understanding intent, not just structure. GitHub has not published the model backing the AI detection, but the output feeds Copilot Autofix, which generates suggested patches directly in the pull request diff view.

honest read: autofix suggestions are not auto-applied. a developer still reviews and accepts each patch before merge. the AI layer accelerates remediation; it does not bypass human review.

org-level dashboards and quality scoring

organization owners get a cross-repository quality dashboard that surfaces maintainability and reliability scores per repo. the scores are composites: CodeQL finding density, AI detection findings, and code coverage percentage. you can sort by score and drill into individual repositories from the dashboard.

code coverage comes from your existing test reports in Cobertura XML format. Code Quality ingests those reports and renders coverage trends and gaps directly on pull requests. if you already produce Cobertura XML from your test runner (Jest, pytest, JUnit — all export it), there is no new test infrastructure to add.

quality gates via rulesets

the GA release adds quality gates as GitHub rulesets. you can require a minimum coverage threshold, a maximum finding count, or a minimum reliability score before a PR can merge. rulesets support an evaluate mode for gradual rollout: evaluate mode reports violations without blocking merges, so teams can instrument first and enforce later.

this matters for AI-generated code in particular. if your team uses Copilot or Claude Code to generate significant portions of each PR, a quality gate that enforces CodeQL clean and a coverage floor becomes the mechanical check that AI output is not silently degrading your repo's health.

who pays, and whether the math works

$10/active committer/month is per-repository. if you enable Code Quality on 10 repos and you have 20 active committers, the base cost is $2,000/month before AI feature consumption. GitHub defines "active committer" as a developer who committed to an enabled repository in the billing period — not a seat count across the org.

for teams already paying for GitHub Enterprise Cloud (around $21/user/month) and GitHub Advanced Security (additional per-committer cost for secret scanning and code scanning), adding $10 for Code Quality adds up fast. the decision is whether the Autofix remediation speed and org-level quality visibility are worth the incremental line item.

for teams that were running CodeQL through GitHub Advanced Security already: Code Quality is additive, not a replacement. GHAS code scanning covers security vulnerabilities; Code Quality adds the maintainability and reliability layer on top.