GitHub Code Quality GA: Draw Three Cost Boundaries Before Enforcing the Gate
GitHub Code Quality became generally available on July 20, moving preview users into billed operation. The first operating task is not a stricter quality score. It is separating three meters that answer different questions: licenses, AI work, and deterministic analysis compute.
Confirmed change
GitHub lists a $10 monthly base license per active committer who pushed to an enabled repository in the previous 90 days. AI-powered detection and Copilot Autofix use AI credits, while deterministic CodeQL analysis consumes GitHub Actions minutes or your self-hosted runner capacity. Code Quality is a standalone product, not an automatic GitHub Advanced Security bundle.
| Cost axis | Meter | Operating question |
|---|---|---|
| Base license | 90-day active committer | Which repos stay enabled? |
| AI work | AI credits | Which detections and fixes? |
| Deterministic scan | Actions / runner | How often should scans run? |
Why immediate blocking is risky
Turning every ruleset into blocking mode on day one can convert legacy debt, generated code, and coverage-format mismatches into a deployment outage. Disabling everything avoids spend but also prevents learning. Start with representative repositories in evaluate mode and review false positives, fix rate, queue time, and cost together.
Phased rollout checklist
✓Budget active committers, AI credits, and Actions minutes separately.
✓Observe two or three representative repositories in evaluate mode.
✓Align Cobertura XML inputs with your existing CI baseline.
✓Treat autofix as a reviewable proposal, not an automatic merge.