What GitHub Announced

GitHub has made Code Quality generally available for GitHub Enterprise Cloud and GitHub Team, positioning the product as a control layer for maintainability, reliability and test coverage at a time when AI-assisted coding is increasing software output.

The service combines CodeQL analysis, AI-assisted detection of maintainability and reliability issues, and Copilot Autofix suggestions inside pull requests. CodeQL is GitHub’s static analysis technology: it inspects source code without running the program, using queries to identify patterns that may indicate defects or risks. In Code Quality, the focus expands beyond security scanning toward day-to-day engineering quality.

From Preview to Organization-Level Governance

Code Quality entered public preview in October 2025. GitHub says more than 10,000 companies used the product during that period. The general availability release adds capabilities aimed at broader team adoption rather than isolated repository checks.

Notable additions include:

• Organization-level enablement, so teams can roll out checks across repositories;
• Dashboards showing maintainability and reliability scores;
• Test coverage metrics, including whether a pull request affects coverage;
• Rulesets for quality gates, with an evaluation mode for staged deployment.

A quality gate is a policy that must be satisfied before code moves forward, such as maintaining coverage above an agreed threshold. GitHub’s approach is to apply these checks earlier in the development workflow, especially during pull request review, rather than treating maintainability as a late-stage cleanup task.

How It Works in Pull Requests and Default Branches

GitHub describes two main operating points. In pull requests, CodeQL reports quality findings with context and can show whether a change impacts test coverage. Copilot Autofix may then propose changes that reviewers can inspect before accepting. On the default branch, Code Quality can identify existing quality debt across the codebase, giving teams a broader view of accumulated issues.

The product does not remove developer responsibility. GitHub says that within its own engineering teams, 67.3% of issues found by Code Quality were resolved before pull requests were merged. However, the company presents this as an early evaluation signal, not as a guarantee of software quality. The tool can identify issues, prioritize them and suggest fixes, but developers still decide what to merge.

That distinction matters for organizations adopting AI coding tools. AI can accelerate code generation, but it does not automatically ensure consistent design, readable implementations or sufficient tests. Code Quality extends GitHub’s existing CodeQL and Copilot Autofix pattern from security into maintainability and reliability governance.

Pricing, Availability and Early Pushback

Code Quality is a separate paid product and is not part of GitHub Advanced Security. Its base price is $10 per active committer per month. GitHub defines an active committer as an organization member who pushed code in the past 90 days to a repository where the feature is enabled; within a single organization, that person is counted once.

AI-assisted detection and Copilot Autofix use usage-based billing, while deterministic CodeQL scans consume GitHub Actions compute. The service supports both GitHub-hosted and self-hosted runners.

For preview users, the pricing shift creates an operational task: existing configurations continue under each customer’s GitHub agreement, but organizations that want to avoid new charges need to check where Code Quality is enabled. At launch, the service is available on GitHub Enterprise Cloud and GitHub Team, but not initially on GitHub Enterprise Server.

Cost and access have already become discussion points. A Reddit thread noted that billing is based on committers rather than reviewers and that the feature is limited to certain GitHub plans. Some users questioned whether organization-wide visibility and automated fix suggestions justify another per-user platform fee. The debate shows that code quality tooling is becoming a budget and governance decision, not just a developer convenience.

A Broader Platform Race

GitHub is not alone in moving code review toward AI-assisted workflow governance. GitLab is pursuing a similar strategy with Duo Code Review, whose agent uses repository, pipeline, security and compliance context to review merge requests and produce structured inline feedback. In March 2026, GitLab announced fixed pricing of $0.25 per agent review, saying the review cost is independent of change size. The capability is available on GitLab.com, Dedicated and supported self-managed deployments.

Atlassian is tying review more closely to work management. Rovo Dev can review pull requests in Bitbucket and GitHub, checking quality, security and performance while also using Jira acceptance criteria and project context to assess whether an implementation matches the intended work. Atlassian says its internal Rovo Dev code review tooling reduced pull request cycle time by 30.8%, though that figure comes from the company’s own engineering environment rather than an independent benchmark.

The direction is clear: AI coding competition is moving beyond code generation into the systems that govern what gets merged. The most useful products will not be the ones that simply propose fixes, but those that connect findings, tests, policy, cost controls and human review into a manageable workflow. For engineering organizations, the practical question is not whether AI can help review code, but how to place it inside clear rules and accountable decision-making.