GitHub Code Quality GA: The $10 Price Hides a Three-Meter Review Loop
GitHub has put a price on the path from finding a defect to asking an AI agent to fix it.
On July 20, GitHub Code Quality reaches its announced general-availability and billing date after a public preview used by more than 10,000 enterprises. The easy headline is $10 per active committer per month on enabled repositories.
That number is also the least useful way to budget the product.
An enabled repository can activate three independent meters: a rolling-90-day committer license, GitHub Actions compute for deterministic CodeQL analysis, and token-priced GitHub AI Credits for model-powered detection and fixes. If a finding is handed to Copilot cloud agent, the remediation can consume more AI and Actions, produce a pull request, and trigger another scan.
So Code Quality is not one AI scanner with a seat price. It is a metered quality loop embedded in GitHub's merge control plane. Repository scope, runner policy, rulesets, AI budgets, and agent permissions now belong in the same design review.
One timing caveat matters. At the research cutoff early on July 20, GitHub's live English documentation still described GA in future tense and no separate rollout-complete notice was visible. July 20 is the confirmed announced effective date; it is not proof that every tenant switched at the same instant.
GitHub's billing documentation describes three cost components after GA. They respond to different engineering behavior.
| Meter | What moves it | Published rate | Control surface |
|---|---|---|---|
| Active committers | Unique eligible people whose commit was pushed to any enabled repository in the previous 90 days | $10 per active committer per month | Repository selection, contributor identity, organization and enterprise scope |
| Deterministic analysis | CodeQL workflow frequency, duration, runner type, pull-request volume, and repository shape | GitHub Actions minutes; current standard Linux x64 rate is $0.006 per minute after allowances | Hosted versus self-hosted runners, scan scope, Actions budgets, queue policy |
| AI-powered work | Tokens used by AI-assisted detection, code review, Autofix, and agentic remediation | 1 GitHub AI Credit = $0.01; no fixed public price per scan or fix | AI budgets, feature policy, remediation route, human approval |
The rough planning formula is:
monthly Code Quality cost
≈ ($10 × unique rolling-90-day active committers)
+ (hosted runner minutes × runner rate)
+ (AI Credits × $0.01)
It is a model, not a forecast. GitHub publishes neither typical Code Quality scan duration nor typical AI Credit consumption for a finding, review, Autofix, or cloud-agent task.
Not every consumed minute becomes marginal cash spend. Private repositories draw from included plan minutes before overage, while standard hosted runners for public repositories and self-hosted runners have different billing treatment. The meter still matters for capacity and attribution even when the next run adds $0 to the invoice.
The definition of active committer deserves attention. GitHub counts an eligible person when one of their commits is pushed to an enabled repository in the previous 90 days, even if the commit was authored much earlier. Members, enterprise-managed users, external collaborators, and pending invitees can qualify. People are deduplicated across enabled repositories and, where applicable, across an enterprise; GitHub App bots are excluded. Treatment of other machine identities is less explicit.
GitHub's preview license estimator shows only that base component. It excludes Actions, AI usage, discounts, and negotiated pricing. A screenshot of that estimate is not a Code Quality budget.
This creates a non-obvious topology effect. A small service touched by 80 developers can have a larger license floor than a huge monolith maintained by 12 people. The monolith may reverse the result on scan compute. Repository targeting and custom properties are economic controls as well as administrative conveniences.
Calling Code Quality an AI code-review gate blurs the architecture GitHub actually documents.
The first lane uses CodeQL rules. According to GitHub's Code Quality product architecture, it analyzes new pull requests targeting the default branch, relevant pull-request updates, and periodic default-branch scans. GitHub documents deterministic quality coverage for C#, Go, Java, JavaScript, Python, Ruby, and TypeScript. Rulesets can require these results and block merges at selected severity thresholds.
The second lane uses a large language model after changes reach the default branch. GitHub's recent-merges tutorial says the AI Findings view can report issues for up to five recently changed files. It can reason across languages and beyond fixed rules, but it is probabilistic and narrower in how much recent code it surfaces.
| Lane | Where it runs | Strength | Boundary |
|---|---|---|---|
| CodeQL quality analysis | Pull requests and default-branch scans | Rule-based, repeatable, suitable for documented ruleset enforcement | Seven named languages and the issues represented by available rules |
| LLM recent-change analysis | After code reaches the default branch | Contextual suggestions across languages without requiring a matching CodeQL rule | Up to five recently changed files, nondeterminism, and no public Code Quality accuracy benchmark |
This separation looks deliberate. GitHub places the more predictable system in front of the merge and the more exploratory system behind it. AI still participates in Autofix and other review surfaces, but the documented preventive quality gate is not a free-form LLM deciding whether every pull request may ship.
GitHub's responsible-use application card is unusually direct about the AI limitations. Findings or fixes can be wrong, incomplete, invalid, based on truncated context, or introduce vulnerabilities and hallucinated packages. Capacity can also affect output. Human review and tests are not optional ceremony around the feature; they are part of its safety case.
The product becomes economically interesting after detection.
Code Quality can generate a Copilot-powered Autofix without requiring a Copilot or GitHub Code Security license. A user can also delegate multi-file work to Copilot cloud agent, which does require a paid Copilot plan. That agent operates as a bounded task with repository write authority, uses AI and Actions, opens a pull request, and still needs human review.
The bill follows the loop: enablement creates the license floor; analysis consumes compute; model work consumes credits; remediation and verification can re-enter both variable meters.
One defect can therefore produce this sequence:
enabled repository
→ CodeQL scan
→ finding or AI-assisted analysis
→ Autofix or cloud-agent task
→ tests and fix pull request
→ merge
→ another scan
Pricing each comment misses the point. The useful unit is dollars per accepted, verified remediation, including reviewer time, retries, rejected patches, tests, and rescans. RohitAI made the same argument about agent credit pools becoming routing and attribution problems. Code Quality applies it to a workflow that can block delivery.
Budgets do more than cap spend.
GitHub documents that a required Code Quality ruleset can block merging while analysis runs, when it fails, or when results exceed the configured threshold. Exhausting an Actions budget is one stated reason analysis may fail. A cautious finance setting can therefore become a repository-wide merge incident.
AI exhaustion fails differently. Deterministic CodeQL may continue while model-powered review or remediation becomes unavailable. If the degraded state is not obvious in dashboards and alerts, developers can mistake the absence of an AI finding for evidence that the code is clean.
Start rulesets in observe mode or at an Errors-only threshold. GitHub itself warns administrators to verify that the dynamically generated quality check runs before making it required; enforcing a check that never reports can block every pull request it covers.
The paid SKU and its surrounding administrative surface are not equally mature.
Repository setup and findings APIs, organization-level targeting, and coverage-based merge protection arrived around the GA window with public-preview labels. The findings REST announcement explicitly describes CodeQL findings. Do not assume the same endpoint is a complete feed of post-merge AI Findings.
The current REST surface is versioned as 2026-03-10, supports listing and retrieving findings, and can read or update repository setup. That is enough to build useful inventory and remediation tooling. It is not enough to promise that every UI signal has a stable automation contract.
Coverage adds another distinction. GitHub's code-coverage feature ingests a separate Cobertura XML report through actions/upload-code-coverage@v1; it is not produced by the CodeQL quality scan. Treat coverage generation, upload latency, fork behavior, and merge-queue behavior as their own pipeline.
The sensible integration posture is a versioned adapter around GitHub's APIs, a test repository that exercises the exact records you depend on, and a rollback path for organization policy. Product GA does not freeze every adjacent schema or control.
Code Quality sits where developers already review and merge code. Findings live beside security signals. Rulesets can enforce them. Autofix can open a patch. A cloud agent can take on a larger repair. Billing, identity, permissions, and dashboards are already attached to the repository.
That is a powerful distribution advantage. It is not an accuracy benchmark.
GitHub publishes no Code Quality-specific precision, recall, false-positive rate, accepted-fix rate, fixed model identity, or neutral head-to-head comparison. Customers can choose scope and budgets, but not switch the model mix used by the product. The documented deterministic gate covers seven languages, and Code Quality is unavailable on GitHub Enterprise Server.
Competitor list prices are tempting but misleading. Semgrep Teams Code publicly lists $30 per contributor and more than 35 languages; Snyk Team starts at $25 per contributing developer but bundles a broader AppSec suite; SonarQube Cloud uses a lines-of-code meter and advertises more than 40 languages. Those products differ in custom rules, deployment model, SAST and supply-chain scope, exclusions, and billing unit. A lower sticker price does not establish equivalent coverage or lower total cost.
Best fit for GitHub Cloud estates concentrated in the seven documented CodeQL languages, with teams that value rulesets, dashboards, Autofix, and low workflow friction more than deep analyzer customization.
The strongest default for enterprises. Compare overlap, unique findings, accepted fixes, latency, noise, and full spend before removing a scanner that already carries policy or compliance weight.
Rational for GHES, air-gapped or regulated environments, polyglot estates, custom-rule-heavy programs, and teams that need path exclusions, model transparency, or deployment controls GitHub does not yet document.
Native integration may win even without the best standalone detector because it reduces the distance from signal to reviewed fix. But until the evidence exists, replacing established controls on faith would turn convenience into unmeasured risk. The earlier GitHub Models retirement is also a reminder that deeper platform consolidation deserves an exit plan.
GitHub's repository rating is useful as a warning light but weak as a KPI. The rating rules classify a repository by its highest-severity open CodeQL finding: no findings is Excellent, Notes only is Good, at least one Warning without an Error is Fair, and any Error makes it Poor.
One Error and 100 Errors both produce Poor. The label says nothing about finding age, recurrence, defect density, accepted fixes, dismissals, or whether a team is improving.
Independent evidence points toward outcome metrics. A 2026 IEEE Transactions on Software Engineering study of more than 22,000 AI review comments across 178 repositories found substantial variation in whether comments led to code changes. It did not test GitHub Code Quality, so it is not a product verdict. It does reinforce the right evaluation unit: what useful work the review caused.
Track at least:
Blanket enablement is easy. A defensible pilot is selective.
Choose repositories by custom properties: one busy service, one monorepo, one low-churn critical system, one repository with generated code, and examples across every language you intend to support. Preserve incumbent checks during the comparison. Instrument costs before tightening policy.
Self-hosted runners may remove GitHub-hosted minute charges, but they do not remove the active-committer license or AI consumption. Compare that saving with runner operations, queue latency, and capacity. Moving a meter off the invoice does not make compute free.
GitHub is not merely selling better lint. It is joining detection, policy, remediation, agent execution, and billing into one repository-native loop.
Three consequences follow.
First, repository architecture now shapes spend. Contributor overlap, service ownership, scan frequency, and runner placement can matter more than raw lines of code. Platform teams will need repository-level attribution, not a single enterprise license card.
Second, the absence of a finding is becoming stateful. It may mean the code passed deterministic rules. It may mean the LLM found nothing. It may mean recent changes fell outside the five-file view, capacity intervened, or a budget blocked model work. Trust requires recording which lane ran and whether it completed.
Third, remediation economics will decide adoption. GitHub can distribute findings at enormous scale, but comments are cheap to create and expensive to review. The winning metric will be verified engineering work removed per dollar, not findings generated per repository.
My high-confidence prediction is that GitHub will add finer repository-, feature-, and workflow-level AI cost attribution. The present estimator cannot reconstruct a loop that crosses licenses, Actions, AI detection, Autofix, and cloud-agent work.
I also expect deterministic CodeQL to remain the main merge-enforcement lane while LLMs expand discovery and remediation. That boundary gives enterprises a stable policy signal without pretending probabilistic review has become perfectly reliable.
Finally, adoption will be tiered. High-churn product repositories, unsupported languages, regulated code, and legacy estates have different economics and risk. Organization targeting will become a combined quality-policy and FinOps tool.
The announced base price is $10 per unique active committer per month across enabled repositories. GitHub separately charges applicable Actions usage for CodeQL scans and AI Credits for model-powered capabilities. Discounts, plan allowances, and negotiated terms can change the invoice.
No. The key event is an eligible user's commit being pushed to an enabled repository within the rolling previous 90 days. GitHub deduplicates qualifying people across repositories and, where applicable, the enterprise. External collaborators and pending invitees can count; GitHub App bots do not.
Only partly. Pull-request quality findings use deterministic CodeQL rules. A separate LLM lane examines recently merged default-branch changes, and AI also powers Autofix and related review work. The distinction matters for language coverage, enforcement, reliability, and billing.
Not to use Code Quality or apply a Code Quality Autofix. You do need an eligible paid Copilot plan to assign remediation to Copilot cloud agent. AI-powered Code Quality work can still consume GitHub AI Credits even without a Copilot seat.
Possibly for some GitHub Cloud teams, but price alone cannot answer that. Run a layered pilot comparing language and rule coverage, deployment requirements, false positives, accepted fixes, exclusions, scan latency, compliance needs, and all three GitHub cost meters.
Confirm the Code Quality check runs reliably on every targeted repository, measure noise in observe mode, start with a conservative severity threshold, and test what happens when Actions or AI budgets are exhausted. Keep human review and tests around Autofix and agent-authored changes.
GitHub Code Quality's GA matters because it turns code review into a budgeted production system.
The $10 license can be attractive. The native workflow can remove real friction. Neither fact tells you the full cost, accuracy, or failure behavior of the loop.
Enable it where GitHub's placement advantage is valuable. Measure the entire path from scan to verified fix. Keep deterministic and probabilistic signals distinct. And do not let a spending cap become an undocumented merge policy.
That is how Code Quality earns its place instead of becoming one more meter attached to the pull request.