Leo

You know that "GA" line in a changelog that you skim past, until a month later Finance emails asking why the invoice grew? This one shipped with the invoice already attached. GitHub moved Code Quality to general availability on GitHub Enterprise Cloud and GitHub Team on July 20, 2026, per the changelog. The pricing meter started the same day.

The offering, minus the marketing paint

Code Quality pairs CodeQL's deterministic analysis with AI-assisted detection for maintainability and reliability issues on pull requests, according to the changelog. Copilot Autofix then proposes fixes you can review before merge. Since the preview, GitHub has added organization-wide enablement with dashboards, code coverage metrics on pull requests, quality gates through GitHub rulesets, and APIs for both management and findings retrieval.

Two things stand out in that inventory. First, this is CodeQL wearing a second hat. The engine most teams already know as GitHub Advanced Security's SAST is now the maintainability and reliability signal too, with an LLM-shaped layer bolted on. Second, the merge decision has been consolidated onto one platform: same identities, same rulesets that already gate your required checks, same billing tenant.

The pricing shape

Here is where "GA" earns its name. GitHub is charging $10 per active committer per month, plus usage-based billing for AI-powered work and compute for CodeQL analysis on GitHub Actions, per the announcement. An "active committer" is anyone who pushed a commit to a repository with Code Quality enabled in the last 90 days. Billing begins automatically at GA.

Read that trailing 90-day window carefully. Enable Code Quality on a repo, and every account that pushes to it counts as active for the following quarter, whether they engaged the quality gate or not. The knob you have is repo-level enablement. The knob you do not have is per-user opt-out inside an enabled repo.

What actually moves in the pipeline

Quality gates plug into GitHub rulesets, which is the same primitive you already use for branch protection. The findings API means a CI job can pull the state of Code Quality on its own schedule, similar to how it pulls other GitHub findings. The dashboards give a platform team one place to look at the trend across repos.

The boundary that quietly moved is the merge decision itself. Before this, "who blocks the merge on quality" was answered by whichever external service your team wired in. Now, if you enable the feature and configure a ruleset, the block lives on the same platform that runs the pipeline and issues the bill. That is a fine deal when the gate is right. It becomes an operational incident the first time the gate is wrong, because the rollback path is now a rulesets audit, not a redeploy of an outside job.

The comparison, honestly

Code-quality gating is a crowded field. Each option answers a slightly different question.

  • SonarQube (self-hosted). The default when your compliance story wants the scanner behind your own firewall. Rich language coverage and its own quality-gate DSL, with an admin surface you have to run yourself.
  • SonarCloud. Same engine, hosted, integrates cleanly with GitHub checks. The honest concession is that if your estate is already inside GitHub Enterprise, the native Code Quality path removes an integration hop SonarCloud still requires.
  • Codacy and Code Climate. Multi-language, opinionated defaults, PR comments as the main surface. Keeping one of these next to Code Quality is a reasonable belt-and-braces move if you want a second opinion outside the platform issuing the block.
  • Semgrep. Rule-first and community-driven. Where Code Quality bundles CodeQL and AI detection into one flow, Semgrep gives you a small, legible ruleset you can read line by line. If your team maintains custom rules, Semgrep is the better fit here.
  • Buddy. A general-purpose CI platform, so Buddy is a place to run a quality-gate step next to your build and deploy stages when your pipeline needs to sit outside GitHub's own orchestration. It earns its keep in mixed stacks where the scanner and the coverage tool have to be swappable boxes. If your merge decision lives entirely inside GitHub rulesets, the native path is closer to the metal.

The 90-day counter is now running

The verdict is straightforward: this is a legitimate consolidation for teams already all-in on GitHub, and a routine billing event for anyone who left the preview enabled and forgot. If Code Quality is on in any of your repos and you did not intend to buy it, today is the day to audit the enablement list. Every committer who touched one of those repos in the last 90 days is already on the meter.

One knob. Ninety-day memory. Enable with your eyes open.