GitHub Code Quality is GA: code review is now a line item
GitHub Code Quality went generally available July 20 at $10 per active committer plus metered AI usage. What per-seat plus per-token pricing means for your dev budget.
GitHub Code Quality shipped to general availability today, and the interesting part isn't the feature list — it's the invoice. GitHub is charging a flat per-committer license and metering the AI work on top of it. Code review just became a two-part line item on your engineering budget, and the second part doesn't have a ceiling you set.
What actually happened
Per the GitHub changelog, Code Quality left public preview today after nine months. It pairs CodeQL's deterministic analysis with AI-assisted detection to flag maintainability and reliability problems on pull requests, and Copilot Autofix proposes patches you approve before merge. GA adds org-wide enablement with dashboards scoring maintainability and reliability across repos, code coverage rendered on PRs from your existing Cobertura XML reports, and quality gates through rulesets — including coverage thresholds, with an evaluate mode so you can roll out without blocking merges on day one.
Pricing is the part to read twice. $10 per active committer per month — active meaning anyone who pushed to an enabled repo in the last 90 days, counted once org-wide, bots excluded. On top of that, usage-based billing for AI-assisted detection and Autofix, which notably does not require a Copilot subscription. And on top of that, Actions compute for the CodeQL runs. Billing started today. It's live on Enterprise Cloud and Team; Enterprise Server doesn't get it at launch.
One scoping note: this is maintainability and reliability, not security. Vulnerabilities still live in code scanning.
Why AI code review pricing matters for your business
We keep seeing the same shape across dev tooling this year: a predictable base license bolted to an unpredictable metered layer. Copilot did it. Now Code Quality does it. The base number is what goes in the budget spreadsheet, and the metered number is what shows up in the actual bill.
If you run a five-developer shop, the base is $50/month. Fine. The AI detection and Autofix spend is whatever your PR volume decides it is, and PR volume in 2026 is going up because agents are opening the PRs. That's the trap — the same automation that increases your throughput increases the thing you're metered on. Nobody models that before turning it on.
Two things worth doing this week. First, turn quality gates on in evaluate mode before you enforce them, or you will spend a sprint arguing with a coverage threshold instead of shipping. Second, watch the metered line for a full billing cycle before you enable it org-wide. If your PR count doubles because agents are writing them, so does the variable spend.
Also: if you're on Enterprise Server, this isn't a decision you get to make yet.
Key takeaways
- GitHub Code Quality hit GA July 20, 2026, at $10 per active committer/month plus metered AI usage plus Actions compute
- An active committer is anyone who pushed to an enabled repo in the last 90 days — counted once org-wide, bots excluded
- Autofix and AI detection bill separately and don't require a Copilot subscription
- Agent-generated PRs inflate the metered layer — model that before you enable it org-wide
- Use rulesets in evaluate mode first; enforce coverage gates only after you've seen the baseline
Watching your dev tooling bill drift? We build CI and review pipelines with the cost model written down up front, so metered AI spend is a number you chose. See how we work.
Sources: GitHub Changelog — Code Quality is now generally available, GitHub Changelog — GA date and pricing announcement.
- #github
- #code-quality
- #developer-tools
- #ai-pricing
- #code-review
Tommy Rush — Founder, Rush Commerce
Operator turned builder. 15+ years running operations — now shipping the systems businesses run on. More
Get The Rush Report weekly — one email, zero fluff.
Keep reading
Cursor's ₹649 India tier: dev seats go geographic
Cursor launched a ₹649/month India-only plan, roughly a third of its $20 Pro tier. AI dev tool pricing is now segmented by market, and that changes your budget math.
Read itvBulletin RCE exploit went public: get to 6.2.2 today
A working exploit for vBulletin CVE-2026-61511 dropped four weeks after the patch. Unauthenticated remote code execution, no in-the-wild reports yet. That window closes fast.
Read it