Deterministic CodeQL analysis catches what rules handle. AI-assisted detection catches what they miss. Together they keep pace with code your developers generate faster than any rule library grows.
GitHub Code Quality
GitHub Code Quality
GitHub Code Quality surfaces findings in pull requests with reviewable fixes before merge, then helps you enforce consistent standards with Rulesets.
Stay in the workflow
GitHub Code Quality surfaces findings directly in pull requests, so developers don’t have to switch to a separate dashboard.
Fix issues as you review
Each finding includes a reviewable fix developers can apply before merging.
Reduce backlog and ship faster
Spend less time triaging quality issues and more time reviewing and shipping fixes.
Everything you need to enforce quality
Fix at the source
Your developers do not open a dashboard. They open a pull request. Copilot Autofix suggests the fix right there. They review, edit, or dismiss it. Nothing merges on its own.
One standard, no matter who or what writes the code
The same Rulesets govern the code your developers write, the findings Copilot code review returns, and the pull requests your coding agents open. Quality and security, one workflow.
Add-on
Bring Code Quality to your organization
Quality in the pull request, governance across your organization.
Code Quality
Quality in the pull request, governance across your organization.
$10USDper committer / month + usage
What's included
- Hybrid detection (deterministic CodeQL plus AI-assisted)
- Autofix in the pull request
- Rulesets quality gates, coverage thresholds, and merge protection
- Maintainability and reliability scoring
- Coverage ingestion (Cobertura XML)
- Organization-wide deployment, dashboards, and APIs
$10 USD per committer / month plus usage-based billing for AI features and Actions minutes. Public repositories: $0 per committer + usage-based billing for AI-powered work. Available on GitHub Enterprise Cloud and GitHub Team.
Frequently asked questions
How much does Code Quality cost?
$10 per committer per month, plus usage-based billing for AI-powered work. Deterministic CodeQL scans use GitHub Actions minutes. Public repositories carry no per-committer charge, with usage-based billing for AI-powered capabilities.
Which languages does Code Quality support?
Java, JavaScript, TypeScript, Python, Ruby, C#, and Go.
Do I need another tool for test coverage?
No. Code Quality renders coverage reports from your existing test tooling in Cobertura XML format, then gates merges on your thresholds through Rulesets. It reads your coverage; it does not instrument your tests.
How is this different from GitHub Advanced Security?
GitHub Advanced Security covers security: Code Security finds vulnerabilities, and Secret Protection finds exposed credentials. Code Quality covers maintainability, reliability, and coverage, and the two disciplines work together. Quality issues are where vulnerabilities can hide, so cleaner code gives your security team less to reason about. Code Quality and Code Security run on the same CodeQL engine, and both report through one Security and quality overview.
Does Code Quality work with Copilot code review?
Yes, as integrated-but-separate experiences. Copilot code review gives your developers in-context feedback while they author, and its comments are ephemeral. Code Quality gives your leaders persistent findings, enforceable gates, and reporting across repositories and time. Both appear in the pull request.
Is Code Quality a compliance product?
No. Code Quality supports internal governance and developer workflow. It is not attestation against a regulatory standard or audit framework.
Can I govern quality across my whole organization?
Yes. Deploy Code Quality organization-wide with dashboards, bulk actions, APIs, and repository- and org-level scoring.
Where can my team learn to set it up?
The GitHub Code Quality learning pathway walks through enabling checks, setting rulesets, fixing findings with Autofix, and reading the dashboards. Start the pathway.