In This Article
Key Takeaways
- GitHub Code Quality moved from public preview to general availability on July 20, 2026, priced at $10 per active committer per month on enabled repositories.
- The base license covers findings, scoring, rulesets, quality gates, and org-wide deployment; AI features such as Copilot code review and Autofix bill separately as usage.
- A separate agentic autofix entered public preview on July 10: Copilot explores the codebase, writes a fix, reruns CodeQL to confirm the alert closes, then opens a draft pull request.
- Code Quality runs on GitHub Enterprise Cloud and Team plans — not Enterprise Server — and agentic autofix needs both a code-security license and Copilot with the cloud agent enabled.
What went live on July 20
GitHub shipped a product it had been previewing for months. Per GitHub's changelog, on July 20, 2026 Code Quality moved from public preview to general availability as a purchasable product, priced at $10 per active committer per month on enabled repositories.
That base license is not just a scanner. GitHub says it covers findings, scoring, rulesets integration, a security-and-quality overview, organization-wide deployment, and quality gates — the plumbing you need to actually block a merge on a maintainability or reliability regression, not just surface one. It is available on GitHub Enterprise Cloud and GitHub Team plans, and GitHub notes it is not available on GitHub Enterprise Server.
The part that changes the workflow
The more interesting release landed ten days earlier. On July 10, GitHub put agentic autofix for code scanning alerts into public preview. The pitch: assign a security alert to Copilot and it works the alert the way a developer would.
GitHub describes the loop plainly. Copilot explores relevant files across your codebase, generates a proposed fix, validates that the fix works by rerunning CodeQL, iterates if the alert does not close, and then opens a draft pull request ready for review. Fix generation typically takes two to four minutes, and the draft PR documents the fix and the validation steps. You can push it further by commenting on the pull request or working the session in the Agents tab.
The distinction that matters: this is not a one-shot suggestion. The agent reruns the actual analyzer to confirm it closed the alert before it asks a human to look. That is the difference between a code suggestion and a verified fix.
What it requires
Agentic autofix is gated behind two licenses. Per GitHub, you need a GitHub Code Security or GitHub Advanced Security license, plus a Copilot license with the Copilot cloud agent enabled.
It is also not free at the margin. During the preview the feature draws down your organization's AI credits, combining with your other Copilot usage, and the agent's activity consumes GitHub Actions minutes — the CodeQL reruns run on Actions. That is the same metered shape as the Code Quality product itself.
Read the pricing before you enable it
The headline number is clean — $10 per active committer per month. The part to model is what sits on top of it. GitHub is explicit that the AI-powered capabilities are billed as usage on top of the base license: Copilot code review, AI-assisted detection, and Copilot Autofix are consumption-based, and the CodeQL-powered maintainability and reliability scans run on Actions and burn Actions minutes.
For a large monorepo with a busy CI pipeline, the Actions consumption is the line item that can surprise you, not the per-seat fee. If you are turning this on across an org, meter one team first and watch the AI-credit and Actions draw for a couple of weeks before you flip it everywhere.
Who should care
Security and platform teams. An autofix that reruns the analyzer to prove it closed the alert is the version worth piloting — it collapses the slow part of the loop, which was never writing the fix but confirming it did not break anything. Keep the human in the review seat; the agent opens a draft PR precisely so a person still approves it.
Teams already paying for Advanced Security. Code Quality GA gives you quality gates and org-wide rulesets in the same place your security alerts already live, so a reliability regression can block a merge the same way a vulnerability does. That consolidation is the real value, more than any single feature.
Everyone else. If you are on GitHub Enterprise Server, none of this reaches you yet — it is cloud and Team only for now. Plan accordingly rather than assuming your next upgrade includes it.
Sources: GitHub Changelog — Code Quality generally available July 20, 2026; GitHub Changelog — Agentic autofix in public preview; byteiota — Copilot agentic autofix coverage. Analysis and framing by Precision AI Academy.
Common questions
How much does GitHub Code Quality cost? $10 per active committer per month on enabled repositories for the base license, plus usage-based charges for AI-powered capabilities like Copilot code review and Autofix, and GitHub Actions minutes for the CodeQL-powered scans. It is available on GitHub Enterprise Cloud and Team plans, not Enterprise Server.
What does agentic autofix actually do? When you assign a code scanning alert to Copilot, it explores relevant files, generates a fix, reruns CodeQL to confirm the alert closes, iterates if needed, and opens a draft pull request for your review. Fix generation typically takes two to four minutes.
Is agentic autofix generally available? No. As of July 2026 it is in public preview. GitHub Code Quality is the product that reached general availability on July 20, 2026; agentic autofix entered public preview on July 10, 2026.