GitHub Code Quality now costs $10 per committer: the 2026 billing model and the audit to run this week

Summary. GitHub Code Quality left public preview on 20 July 2026 and billing began automatically that day at $10 per active committer per month, plus usage-based charges for AI-powered work and GitHub Actions minutes for deterministic CodeQL scans. More than 10,000 enterprises ran it free during the preview, and GitHub confirms there is nothing to migrate: it keeps running on your existing agreement, now as a paid product. The counting rule is the part that surprises people. A committer is active when they have pushed a commit to a Code Quality-enabled repository in the last 90 days, each one is counted once across the whole organisation no matter how many repositories they touch, and bot accounts are not charged. That makes headcount coverage the cost driver, not repository count. Code Quality runs on GitHub Enterprise Cloud and GitHub Team, and is not available on GitHub Enterprise Server. GitHub reports that inside its own engineering organisation, teams "resolve 67.3% of Code Quality findings before merging pull requests." This is the billing model in full, a worked cost model at three org sizes, and the audit to run before your first invoice.

What changed on 20 July 2026

Code Quality pairs CodeQL's deterministic analysis with AI-assisted detection to catch maintainability and reliability problems in pull requests, and Copilot Autofix proposes fixes for review before merge. GitHub positions it as a standalone paid product, "complementary to GitHub Advanced Security rather than bundled with it" — so an existing Advanced Security purchase does not cover it.

GitHub gave five weeks of notice. The 16 June 2026 changelog announced the date, the price and the instruction to disable Code Quality before 20 July if you did not want to pay, and organisation settings gained a bulk disable path at that point. On 13 July, a license estimate landed in public preview so admins could see their committer count before the meter started.

Several capabilities arrived with general availability rather than during the preview:

• Organisation-wide enablement with organisation-level dashboards showing maintainability and reliability scores across repositories.

• Code coverage metrics rendered on pull requests from existing test reports in Cobertura XML format.

• Quality gates through GitHub rulesets, including coverage thresholds, with an evaluate mode for gradual rollout.

• APIs to manage repository enablement and fetch findings.

The three billing components

The licence line covers findings, scoring, rulesets integration, security and quality overview integration, organisation-wide deployment, and quality gates that block pull request merges on maintainability, reliability or coverage thresholds. GitHub describes deterministic analysis as "fast, predictable, and free of AI usage charges" — the CodeQL half of the product costs you compute, not tokens.

The 90-day rule changes which repositories are worth enabling

Read the counting rule carefully, because it inverts the intuition most teams bring to per-seat tooling.

Each active committer is billed once across the organisation regardless of how many enabled repositories they contribute to. So enabling Code Quality on ten more repositories that the same forty engineers already work in adds nothing to the licence line. Enabling it on one repository owned by a separate team of forty adds $400 a month. The marginal cost of coverage is the marginal cost of people, not repositories.

That has three practical consequences.

Broad enablement inside a team is close to free once anyone on that team is already counted. If your platform team of twelve is already billed, turning Code Quality on across all thirty of their services costs nothing extra in licence — only Actions minutes.

An archived or barely-touched repository can still be expensive if it is the only place a particular group pushes. One quarterly contributor who pushes a documentation fix inside the 90-day window is a full $10 that month, and the window means they keep billing for three months after that single push.

Bot-heavy repositories are cheap. Renovate, Dependabot and release automation do not add to the licence, so a repository whose commit history is mostly machine-generated is a good candidate for coverage.

What it actually costs: three worked examples

The figures below apply GitHub's published rates to three organisation shapes. The committer counts, pull request volumes and scan durations are assumptions for illustration, not GitHub figures; the per-minute rates come from GitHub's Actions runner pricing reference, where Linux 2-core (x64) is $0.006 per minute and the 8-core larger runner is $0.022 per minute as of July 2026. GitHub rounds each job's minutes up to the nearest whole minute, which matters when your scans are short and numerous.

Two readings follow. First, at typical PR volumes the compute line is noise next to the licence — until you move to larger runners for monorepo scans, where it becomes roughly 11 percent of the bill in the third row. Second, the annualised licence for the 200-engineer case is $21,600, which is the number that will actually get discussed in a budget review, not the $1,800 monthly figure. In Indian terms, that same 180-committer licence is roughly ₹1,55,000 a month at mid-2026 exchange rates, before any Actions or AI charges.

The AI-powered component is the one you cannot model in advance. GitHub prices AI-assisted detection and Copilot Autofix generation as metered usage and does not publish a per-finding rate, so the only honest planning approach is to run a month, read the usage report, and extrapolate. Teams already managing Copilot spend can put Code Quality usage inside the same controls; our note on AI credit pools for cost centers covers how that allocation works.

Why Actions minutes are cheaper than they were

Code Quality's compute line lands in a year when Actions got cheaper, which softens the blow. On 1 January 2026 GitHub reduced hosted-runner prices by up to 39 percent, driven by roughly a 40 percent cut across all runner sizes paired with a new $0.002 per-minute Actions cloud platform charge that is already folded into the listed meter rates. There is no separate platform line on your bill for hosted runners.

One widely repeated claim is wrong and worth correcting before you budget around it. The $0.002 per-minute charge for self-hosted runners in private repositories, originally announced for 1 March 2026, was postponed. GitHub's own changelog entry opens with it: "We're postponing the announced billing change for self-hosted GitHub Actions to take time to re-evaluate our approach. We are continuing to reduce hosted-runners prices by up to 39% on January 1, 2026." If you run CodeQL on self-hosted runners, that path has not become billable.

For scale, GitHub put the impact of the January change at 96 percent of customers seeing no change to their bill, with 85 percent of the affected 4 percent seeing a decrease and the remaining 15 percent facing a median increase of around $13. The Actions line is not where your Code Quality budget goes.

The current standard rates are worth having in front of you when you choose where CodeQL runs:

The arm64 2-core runner is $0.005 against $0.006 for x64, a 17 percent saving on identical core counts. For CodeQL scans of a language that builds cleanly on arm64, that is a free reduction. Note also that included minutes cannot be used for larger runners, and larger runners are not free even for public repositories.

The five-step audit to run this week

One: read the licence estimate before you read anything else. Go to the billing entity's Billing and licensing page and open Licensing. The Code Quality card shows consumed licences and estimated monthly payment. GitHub is explicit about what it leaves out: the estimate covers only the per-committer licence, excludes Actions minutes and AI usage such as Copilot Autofix, and reflects standard list pricing without any discounts on your account. Treat it as a floor.

Two: list every repository where Code Quality is enabled. Organisation-level enablement means it may be on in places nobody chose deliberately. Code Quality now ships APIs to manage repository enablement and fetch findings, so this can be scripted rather than clicked. Pair the repository list with the committer list; the intersection is your bill.

Three: find the committers who exist only because of one repository. These are the expensive ones. Sort your active committers by how many enabled repositories they push to. Anyone appearing in exactly one, especially a low-traffic or archived repository, is a candidate to remove from scope by disabling Code Quality on that repository. Anyone appearing in eight is already paid for and costs nothing more.

Four: separate the compute line. Pull the Actions usage report and isolate CodeQL job minutes from the rest of CI. If those scans run on macos or on larger runners without a technical reason, moving them to actions_linux or actions_linux_arm is a same-day change with an immediate rate difference.

Five: decide and act per organisation, not per repository. Disabling Code Quality stops future scans and charges. Because the licence counts people once, the decision that moves money is which groups stay in scope. Halving repository coverage while keeping the same engineers in scope saves almost nothing.

Is it worth $10 per head?

The comparison that matters is not against zero, it is against what the finding would have cost later. GitHub's disclosed internal number — teams resolving 67.3 percent of Code Quality findings before merging pull requests — is a pre-merge catch rate, and pre-merge fixes are the cheapest kind. At $10 per committer per month, the product pays for itself if it prevents roughly one meaningful production defect per engineer per year, which is a low bar for most teams shipping at pace.

The argument against is narrower and worth stating plainly. If you already run SonarQube, Qodana or an equivalent with quality gates wired into your pipeline, Code Quality duplicates a control you have paid for, and the honest move is to pick one rather than run both and pay twice. The same logic applies to teams whose review bottleneck is people rather than tooling; another scanner does not fix a shortage of reviewers.

The awkward middle case is the team that turned Code Quality on during the free preview, never wired the findings into anything, and has now started paying for dashboards nobody opens. That is the situation the 20 July date created at more than 10,000 enterprises simultaneously, and it is why the audit above is worth an hour this week rather than a surprise next month.

India-specific considerations

For Indian services firms and product teams, three points matter.

Contractor churn interacts badly with the 90-day window. A team that rotates contractors on short engagements will keep paying for people who left, because the window looks back three months from any single push. If your delivery model involves short-term contributors, expect the billed committer count to run above your current headcount, and check the estimate against your actual roster rather than assuming they match.

Currency exposure is the second. The licence is dollar-denominated, so a 180-committer organisation carries roughly ₹1,55,000 a month of foreign-currency cost at mid-2026 rates, and the rupee figure moves without any change in usage. Budget in dollars and convert, not the other way round.

Client-account structures are the third. Firms that hold separate GitHub organisations per client cannot pool committers across them — the once-per-organisation counting rule is per organisation, so an engineer working across three client organisations is billed three times. Consolidating delivery into one organisation with repository-level access controls is the structural fix, though it is a governance decision, not just a billing one.

What to do about it

The one-hour version: open the licence estimate, list enabled repositories, find the single-repository committers, move CodeQL scans to the cheapest runner that builds your code, and disable Code Quality anywhere the findings are not wired into a ruleset or a review workflow. The one-quarter version: decide whether Code Quality or your incumbent scanner owns the quality gate, and turn the other one off.

Paying for a scanner nobody reads is worse than not scanning, because it buys the feeling of a control without the control.

FAQ

How eCorpIT can help

eCorpIT is a CMMI Level 5 certified technology consultancy in Gurugram, and our senior engineering teams run the developer-platform and pipeline work for product organisations across India and abroad. We audit tooling spend the way this article does: read the licence estimate, map committers to enabled repositories, separate compute from licence, and decide which scanner owns the quality gate rather than paying two vendors for the same control. If you want that audit run against your GitHub organisation before the first invoice lands, talk to our team.

References

1. GitHub Code Quality is now generally available — GitHub Changelog, 20 July 2026

1. GitHub Code Quality generally available July 20, 2026 — GitHub Changelog, 16 June 2026

1. GitHub Code Quality license estimate in public preview — GitHub Changelog, 13 July 2026

1. Actions runner pricing — GitHub Docs

1. Update to GitHub Actions pricing — GitHub Changelog, 16 December 2025

1. GitHub Code Quality billing — GitHub Docs

1. About GitHub Code Quality — GitHub Docs

1. Organization-level enablement for GitHub Code Quality — GitHub Changelog, 16 June 2026

1. Organization-level targeting for GitHub Code Quality — GitHub Changelog, 9 July 2026

1. GitHub Actions billing and usage — GitHub Docs

1. Code Quality product page — GitHub

Last updated: 22 July 2026.