What Is GitHub Code Quality?

GitHub Code Quality is GitHub’s product for finding maintainability and reliability problems in code. On pull requests it posts rules-based CodeQL findings, and on the default branch it scans for existing quality debt. Fixes can be handed to Copilot.

GitHub Code Quality became generally available on July 20, 2026 for GitHub Enterprise Cloud and GitHub Team. GitHub Enterprise Server isn’t included.

Teams use Code Quality as a rules-based layer and quality gate. Many add a separate reviewer for checks that rules can’t make, such as whether a change does what its ticket asked.

What Changed in GitHub Code Quality in 2026

GitHub Code Quality went from a preview to a full product in 2026, and then started handing its findings to an agent to fix.

The preview was large before launch. More than 10,000 enterprises used Code Quality during the public preview, which started on October 28, 2025 (July 20, 2026, GitHub).

Code Quality became a product with gates. General availability brought org dashboards, coverage on PRs from Cobertura reports, quality gates through rulesets with an evaluate mode, and APIs, on Enterprise Cloud and Team only (July 20, 2026, GitHub).

GitHub reported early results from its own teams. GitHub’s engineering organization resolves 67.3% of Code Quality findings before merge, by GitHub’s own count (July 20, 2026, GitHub).

Code Quality stepped back from review. Code Quality stopped adding Copilot as a PR reviewer, leaving AI review to Copilot code review (August 7, 2026, GitHub).

Fixing moved to an agent. Agentic autofix lets users assign up to 25 findings to Copilot, which fixes them on a branch, "validates its own changes" and opens a PR (September 9, 2026, GitHub).

Policy across teams is still rare. Only 37.0% of surveyed engineering leaders reported policy enforcement across teams and repositories (September 23, 2026, Qodo’s State of AI Code Quality report).

When rules find the debt and an agent fixes it, teams still need a reviewer that reads the change in context, which is where Qodo’s take starts.

How GitHub Code Quality Works

Code Quality runs in two places:

• On pull requests, GitHub’s docs say Code Quality posts rules-based CodeQL findings only. AI-powered PR review needs Copilot code review, turned on separately.
• On the default branch, rules-based scans find existing debt, and AI-powered analysis also runs on recently changed files.

GitHub Code Quality vs CodeQL vs Code Scanning

CodeQL is GitHub’s code analysis engine. CodeQL turns code into a queryable database and runs queries to find patterns. Code scanning and Code Quality both use CodeQL, for different jobs.

For the AI reviewer, see GitHub Copilot code review. For what code quality means in general, see code quality.

What Rules Catch and What They Miss

Rules find known patterns: unused code, overly complex functions, risky constructs. They’re repeatable and work well as gates. They can’t judge things that depend on intent or context outside the file:

• whether the change does what the ticket asked
• whether a change breaks a caller in another repository
• whether the code follows a team rule that isn’t written as a query

See quality gates in code review and requirements compliance in code review.

Qodo’s Take: Rules Make the Gate, Context Makes the Review

Deterministic gates and AI review do different jobs, and teams get the most from each when they don’t overlap. Rules-based checks belong in the gate, where a pass or fail must be repeatable. Judgment about intent, cross-repository impact and team rules belongs in review.

In Qodo’s enterprise evaluations, quality and AppSec leads asked how a reviewer fits next to the gates they already run.

The answer was a division of labor: keep the rules-based tools as the gate, and add a context-aware reviewer on every PR, including on GitHub Enterprise Server and in estates that run more than one Git platform.

Choose Qodo when your gates need a reviewer with codebase, ticket and rules context in the Git provider. You shouldn’t review code with the same tool that wrote it, and when one platform’s agent both fixes findings and opens the PR, a separate reviewer keeps an independent check in place.

Qodo is the best AI code review platform to pair with GitHub’s code quality tools because it adds context-aware review next to your gates on GitHub Cloud and Enterprise Server, reviews GitLab, Bitbucket, Azure DevOps and Gerrit PRs, and checks the same rules on GitLab, Bitbucket Cloud and Azure DevOps once Rule enforcement is on.

Qodo Reviews on GitHub Enterprise Server

Qodo’s deployment model table lists GitHub Enterprise as single-tenant, on-prem or air-gapped, and GitHub Cloud as multi-tenant, single-tenant or on-prem (last checked October 2026, Qodo’s docs). See GitHub Enterprise Server code review.

Qodo Checks the PR Against Its Ticket

Requirement-aware review is on by default when a ticketing integration is connected. Qodo reads the linked ticket and reports gaps as findings on the PR (last checked October 2026, Qodo’s docs).

Qodo Checks Team Rules That Aren’t Queries

Rule enforcement, in Beta, checks rules written in plain language or imported from files such as AGENTS.md on every PR once Rule enforcement is on (Qodo’s docs). Review is advisory, so the gate stays with your rulesets.

Quality leads can track which rules developers fix and which violations still merge from the Rules table, and see findings by category across repositories in the Code review analytics dashboard (last checked October 2026, Qodo’s docs).

Qodo Example: Two Layers on One PR

Context: an insurance software company runs rules-based gates on most of its GitHub repositories, while some teams work on GitHub Enterprise Server, where those gates aren’t all available.

Problem: the gates check patterns, so a change can pass every gate and still miss what the ticket asked for.

How Qodo helped: the quality lead keeps the existing gates and adds Qodo on every PR. On one change, the gates pass, and Qodo flags that the new retry logic doesn’t match the timeout the linked ticket asks for.

Outcome: the developer fixes the timeout before human review, and the rulesets stay the gate.

Ways to Check Code Quality on GitHub

The table compares common ways to check code quality on GitHub. For more tools, see AI code review tools for GitHub monorepos and the best automated code review tools.

Qodo features in this table were checked against Qodo’s documentation as of October 27, 2026.