GitHub Code Quality in public preview

[ebndev]

GitHub Code Quality is now available in public preview! It turns every pull request into an opportunity to improve. With in-context findings, one-click Copilot fixes, and reliability and maintainability scores, you spend less time chasing nits and more time building. It’s there when you need it most, surfacing quality issues both in the pull request and the backlog so you can fix technical debt on your schedule.

Who this is for

Developers and engineering teams who want in‑context feedback about the quality of their code and an easier way to turn technical debt into reviewable fixes.

Highlights

• One-click enablement: Try GitHub Code Quality quickly and easily.
• Actionable findings: CodeQL-based quality rules detect maintainability and reliability issues in Java, C#, Python, JavaScript, Go, and Ruby.
• Reviews in context: See quality findings directly in the pull request with guidance you can immediately act on.
• Track progress with quality scores: Quality repository view groups findings by rule so you can prioritize fixes, while reliability and maintainability scores summarize their severity to help you target improvements.

How to try it

1. If your organization has preview features enabled, go to Settings > Code quality in your repository and enable the feature.
2. Open a pull request in a supported language and review any inline findings and autofix suggestions.
3. If you don’t have access yet, ask an organization admin to enable the preview flag for your organization. See more in our documentation on enabling Code Quality.

Coming soon

• Organization-level dashboards and enablement to manage code quality at scale.
• Test coverage metrics to provide actionable quality data.
• APIs to programmatically fetch code quality data or enable it at scale.
• Copilot-powered quality recommendations for pull requests to supplement static analysis findings.

Availability and pricing

GitHub Code Quality is available today for GitHub Enterprise Cloud and Team, but not available on Enterprise Server. It's free during the preview period, however scans will incur Actions minutes.

Learn more

Check out our GitHub Code Quality documentation

🌟Leave a comment!

Join the discussion and leave feedback in the comments below!

Disclaimer: The UI for features in public preview is subject to change.

[stasostrovskyi]

This is an amazing feature! Especially great to see a blend of AI scan and CodeQL. I have couple of questions:

• Is it the same logic under the hood that is used for new copilot review and this feature?
• Is it possible (or is it considered on the roadmap) to customize codeql workflow used by code quality? Our use case would require running on self-hosted agents (which is already available) and have access to the dependency cache so that workflow wouldn't spend a lot of time on downloading dependencies but rather go straight to the analysis?

[carogalvin]

👋🏻 Hi @stasostrovskyi , I'm the PM in charge of this feature at GitHub!

• Yes, it is the same logic under the hood as with Copilot code review
• I'm curious to learn more about what you need customized for the workflow; do you do this with the security code scanning / codeQL action today?

[stasostrovskyi]

Hi @carogalvin! Thank you for quick response!

I will try to summarize multiple different aspects on how we work at our organization:

• We use self-hosted runners (ARC) on GCP with a lot of GCP services nearby, most relevant Artifact Registry to store our own dependencies.
• Artifact Registry is not the fastest out there, especially for Java, so caching plays a pivotal role in all our workflows. We even have our own caching action with gcp buckets and slightly relaxed rules compare to github one.
• On top of all this, we also have way more repositories than people, so we standardize our CI/CD workflows heavily. We have central repository with shared workflows for all standard cases and then we create new repositories from templates that already have built-in workflows that only call shared ones, possibly with some inputs.
• We also love required workflows as a way of adding workflows to PRs based on custom properties without changing repos all the time. This allows us to "group" repos and rollout new github features gradually.
• When we first introduced CodeQL, especially for Java, it took around 4-5 minutes on PRs, which was considered too long, because many of our builds (thanks for caching as well) are usually below 3 minutes.
• We have also tried to rollout CodeQL carefully, so turning on/off rulesets or even separate rules has proven to be very useful.

All in all, I feel that having codeql.yml similar to copilot-setup-steps.yml would be amazing to have for enterprise customization (and possibly for adding more tools that can feed to advanced security through sarif). Even though right now it's possible to choose ARC to run code quality it fails every time on ARC agents because there is no java/node there, which is usually installed through custom workflows.

[carogalvin]

@stasostrovskyi thank you for your response!

[marwin1991]

Also, we just turned on GitHub Code Quality for our open source organisation!

Check it out here: github.com/logchange

Thanks to the GitHub team for creating this feature — it’s already making our reviews smoother! 🚀

[eai04191]

In my repository, I encountered an error and was unable to enable the Code quality feature while the "Require actions to be pinned to a full-length commit SHA" setting was enabled in Actions permissions.

As soon as I disabled this full-length SHA requirement, I was able to enable the feature immediately.

Are these two compatible?

[garrettld]

I ran into this same problem. Even if actions/* and github/codeql-action/* are allowed, this error still appears until you uncheck the "Require actions to be pinned to a full-length commit SHA"

Unchecking the checkbox allows you to enable Code Quality on a repo, and once that's done code quality scans appear to work fine even once you re-check the checkbox.

[carogalvin]

👋 Hey, I'm the PM who owns this feature at GitHub!

We are working right now on being able to enable this feature even with those particular actions policies; this should be available by the end of November.

[sstrullmyer]

Great to see this come to public preview!

Do you anticipate enabling additional quality checkers to provide results to GitHub Code Quality, similar to how GHAS supports uploading SARIF files from tools which are capable of exporting data in that format?

For example, our developers already use popular tools for their respective ecosystems (e.g., ruff for Python) locally and in their pipelines, and being able to understand these code quality findings at scale through GitHub Code Quality would be incredibly helpful

[carogalvin]

@sstrullmyer thanks for your feedback! We don't have 3rd party extensibility on our roadmap at the moment, but I've made note of your feedback.

[mbenson-smartx]

This is great and looks like its finding some real issues. It really needs to run on PR and allow the repo to gate based on level (i.e. Warning Error)

[sstrullmyer]

Is this what you have in mind: https://docs.github.com/en/code-security/code-quality/how-tos/set-pr-thresholds#adding-or-updating-a-ruleset-to-include-code-quality

[mbenson-smartx]

Maybe. I am trying to prevent code getting into main but the code quality appears to only run on main. I want the developer to know as early in the cycle as possible that they need to repair it. I see that a code quality check ran on a PR but I don't see any results.

[carogalvin]

Thanks for the feedback! Yes, right now code quality will only run on the default branch and on PRs to the default branch. We're looking to expand branch coverage in the future!

[mbenson-smartx]

Thanks for the feedback! Yes, right now code quality will only run on the default branch and on PRs to the default branch. We're looking to expand branch coverage in the future!

Thanks for the update! Loving it so far.

[ica-ft]

Is there some way to get the Code Quality info via the Github API's?

[carogalvin]

👋 Hi @ica-ft , I'm the PM who worked on this feature! We do not have APIs available yet but will be working on those soon; what sort of information will you want to pull from the APIs?

[ica-ft]

Hey @carogalvin, and thanks for getting back so quickly.

Thinking from a platform perspective, maybe one endpoint for a list of issues found, and an endpoint that gives the total nr of issues. Both endpoints filterable on Severity, Category and language. It would also be nice if the API's could carry a link to the filtered list on Github so you can jump over to more actions on GH.

[carogalvin]

@ica-ft thanks for your feedback!

[zeenix]

Java, C#, Python, JavaScript, Go, and Ruby.

Did you forget to mention Rust or is that somehow not supported despite being the most loved language for several years in a row (according to stackoverflow)? 🤔

[carogalvin]

Hi @zeenix , we don't currently support Rust but are hoping to in the future.

[HoangHades]

I tried to set code quality thresholds for pull requests
However, the merging is blocked with the message Code quality results are pending even if CodeQL passed

[carogalvin]

Hm, that's odd. Do you see the Actions workflow as having completed in the Actions tab?

[jsoref]

It needs to be easy to tell Code Quality to ignore specific files (especially minified files).

https://github.com/check-spelling-sandbox/adk-python/security/quality

src/google/adk/cli/browser/main-MIUNGJ3Y.js (295)

[jsoref]

Preview unavailable sometimes appears for minified files (but confusingly not always).

Consider:

https://github.com/check-spelling-sandbox/adk-python/security/quality/rules/js%2Funreachable-statement

Compare:

https://github.com/check-spelling-sandbox/adk-python/security/quality/rules/js%2Fuseless-expression

[jf205]

Thanks for the report @jsoref. We will look into this!

[alijrizvi]

This has the potential to be so useful! Reviewing your work and getting valuable feedback is so crucial, and this will be another way for organizations to do so; even individuals can improve their work from such feedback. Good stuff!