GitHub Code Quality in public preview #177488
Replies: 40 comments 94 replies
-
|
This is an amazing feature! Especially great to see a blend of AI scan and CodeQL. I have couple of questions:
|
Beta Was this translation helpful? Give feedback.
-
|
@EelcoLos unfortunately we don't have a specific plan for that at this time :( |
Beta Was this translation helpful? Give feedback.
-
@carogalvin is there going to then be at least adherence to the 'dynamics' part of the |
Beta Was this translation helpful? Give feedback.
-
hi @EelcoLos , do you know by any chance what configuration options we'll have in the UI? For me, the most important is the trigger, I don't want this workflow on every single commit and I want it to be able to not run if the unit tests workflow is still running. It spends github actions minutes, so any configuration to optimize this would be great! If you can provide any feedback I appreciate it, thanks 🙂 |
Beta Was this translation helpful? Give feedback.
-
|
Hi @BOLT04 , we don't have specific items on our roadmap right now for which configuration options we will be adding. Thank you for feedback/request! |
Beta Was this translation helpful? Give feedback.
-
If you're having trouble with your CodeQL scans, I recommend discussing in the CodeQL open source repo: https://github.com/github/codeql |
Beta Was this translation helpful? Give feedback.
-
|
Also, we just turned on GitHub Code Quality for our open source organisation! Check it out here: github.com/logchange Thanks to the GitHub team for creating this feature — it’s already making our reviews smoother! 🚀 |
Beta Was this translation helpful? Give feedback.
-
In my repository, I encountered an error and was unable to enable the Code quality feature while the "Require actions to be pinned to a full-length commit SHA" setting was enabled in Actions permissions. As soon as I disabled this full-length SHA requirement, I was able to enable the feature immediately. Are these two compatible? |
Beta Was this translation helpful? Give feedback.
-
|
I ran into this same problem. Even if actions/* and github/codeql-action/* are allowed, this error still appears until you uncheck the "Require actions to be pinned to a full-length commit SHA" Unchecking the checkbox allows you to enable Code Quality on a repo, and once that's done code quality scans appear to work fine even once you re-check the checkbox. |
Beta Was this translation helpful? Give feedback.
-
|
👋 Hey, I'm the PM who owns this feature at GitHub! We are working right now on being able to enable this feature even with those particular actions policies; this should be available by the end of November. |
Beta Was this translation helpful? Give feedback.
-
|
@carogalvin did this happen? (We're in december) |
Beta Was this translation helpful? Give feedback.
-
|
@jsoref yes! https://github.blog/changelog/2025-11-25-code-scanning-default-setup-bypasses-github-actions-policy-blocks/ |
Beta Was this translation helpful? Give feedback.
-
|
Great to see this come to public preview! Do you anticipate enabling additional quality checkers to provide results to GitHub Code Quality, similar to how GHAS supports uploading SARIF files from tools which are capable of exporting data in that format? For example, our developers already use popular tools for their respective ecosystems (e.g., ruff for Python) locally and in their pipelines, and being able to understand these code quality findings at scale through GitHub Code Quality would be incredibly helpful |
Beta Was this translation helpful? Give feedback.
-
|
@sstrullmyer thanks for your feedback! We don't have 3rd party extensibility on our roadmap at the moment, but I've made note of your feedback. |
Beta Was this translation helpful? Give feedback.
-
|
A common workaround is a single consolidated PR gate fed by external analyzers. We’re doing this for architecture drift (PR-delta, low noise). Free GitHub app: https://github.com/apps/revieko-architecture-drift-radar |
Beta Was this translation helpful? Give feedback.
-
|
This is great and looks like its finding some real issues. It really needs to run on PR and allow the repo to gate based on level (i.e. Warning Error) |
Beta Was this translation helpful? Give feedback.
-
|
Is this what you have in mind: https://docs.github.com/en/code-security/code-quality/how-tos/set-pr-thresholds#adding-or-updating-a-ruleset-to-include-code-quality |
Beta Was this translation helpful? Give feedback.
-
|
Maybe. I am trying to prevent code getting into main but the code quality appears to only run on main. I want the developer to know as early in the cycle as possible that they need to repair it. I see that a code quality check ran on a PR but I don't see any results. 
|
Beta Was this translation helpful? Give feedback.
-
|
Thanks for the feedback! Yes, right now code quality will only run on the default branch and on PRs to the default branch. We're looking to expand branch coverage in the future! |
Beta Was this translation helpful? Give feedback.
-
Thanks for the update! Loving it so far. |
Beta Was this translation helpful? Give feedback.
-
|
Is there some way to get the Code Quality info via the Github API's? |
Beta Was this translation helpful? Give feedback.
-
|
👋 Hi @ica-ft , I'm the PM who worked on this feature! We do not have APIs available yet but will be working on those soon; what sort of information will you want to pull from the APIs? |
Beta Was this translation helpful? Give feedback.
-
|
Hey @carogalvin, and thanks for getting back so quickly. Thinking from a platform perspective, maybe one endpoint for a list of issues found, and an endpoint that gives the total nr of issues. Both endpoints filterable on Severity, Category and language. It would also be nice if the API's could carry a link to the filtered list on Github so you can jump over to more actions on GH. |
Beta Was this translation helpful? Give feedback.
-
|
@ica-ft thanks for your feedback! |
Beta Was this translation helpful? Give feedback.
-
Did you forget to mention Rust or is that somehow not supported despite being the most loved language for several years in a row (according to stackoverflow)? 🤔 |
Beta Was this translation helpful? Give feedback.
-
|
Hi @zeenix , we don't currently support Rust but are hoping to in the future. |
Beta Was this translation helpful? Give feedback.
-
|
I tried to set code quality thresholds for pull requests |
Beta Was this translation helpful? Give feedback.
-
|
@cannist |
Beta Was this translation helpful? Give feedback.
-
|
Hmm, ok. And this persists and does not resolve itself a bit later, @HoangHades? Even if you reload the page? After the workflow has finished we still need to process the uploaded results which could add a bit of delay but should not take too long. |
Beta Was this translation helpful? Give feedback.
-
|
@cannist |
Beta Was this translation helpful? Give feedback.
-
|
Thank you, @HoangHades. I was able to figure out what is happening here. The PR you linked is not a PR against your default branch (even though the branch name sounds like it would be the default branch). Right now code quality will only run on the default branch and on PRs to the default branch. So when configuring the ruleset you should not configure it to cover any branch other than the default one since the rule will always block in these cases. As @carogalvin wrote above we're looking to expand branch coverage in the future. |
Beta Was this translation helpful? Give feedback.
-
|
@cannist |
Beta Was this translation helpful? Give feedback.
-
|
It needs to be easy to tell Code Quality to ignore specific files (especially minified files). https://github.com/check-spelling-sandbox/adk-python/security/quality
|
Beta Was this translation helpful? Give feedback.
-
|
Thank you for this feedback! |
Beta Was this translation helpful? Give feedback.
-
|
Consider: 
Compare: https://github.com/check-spelling-sandbox/adk-python/security/quality/rules/js%2Fuseless-expression 
|
Beta Was this translation helpful? Give feedback.
-
|
Thanks for the report @jsoref. We will look into this! |
Beta Was this translation helpful? Give feedback.
-
|
This has the potential to be so useful! Reviewing your work and getting valuable feedback is so crucial, and this will be another way for organizations to do so; even individuals can improve their work from such feedback. Good stuff! |
Beta Was this translation helpful? Give feedback.
-
|
I found this dashboard really helpful, a couple of potential features I'd love to see
|
Beta Was this translation helpful? Give feedback.
-
|
Thanks for the feedback!
Please can you explain in a little more detail what you mean by this please? Clicking a specific rule takes you to a view of all the places in the code where the findings are located. How can we improve that view to make it more useful for you?
Totally agree. We have plans to improve the way we display these metrics! 👍🏻 |
Beta Was this translation helpful? Give feedback.
-
When the collapsible rules were expanded, I'd expected to be able to use the individual entries to be able to navigate to those specific lines of code. I missed that the text of the collapsible rule itself could be clicked to see all of the instances!
Awesome, I look forward to seeing this feature improve further! |
Beta Was this translation helpful? Give feedback.
-
|
I see that CodeQL already supports C / C++, are there any plans to extend this feature to officially support them too? |
Beta Was this translation helpful? Give feedback.
-
|
Yes, expansion to C/C++ is something we'd like to get to in the future, but we do not currently have a target date for this. |
Beta Was this translation helpful? Give feedback.
-
|
Hey @carogalvin - congrats on the public preview release! I’m using it in a few personal projects, and love it! Do you see this becoming available in GHES in a future release? |
Beta Was this translation helpful? Give feedback.
-
|
Hi! Thanks for your question! Let me jump in here while Caro is enjoying some well-deserved time off. The new Code Quality product has AI detections (+ CodeQL) and AI remediations at its very core. At the moment, we can't offer those on GHES. However, we're keeping a close eye on customer feedback on this front (like yours!) to help us decide whether we need to change this direction going forward. If we do, we'll make sure to announce it here and on the GitHub public roadmap. |
Beta Was this translation helpful? Give feedback.
-
|
@carogalvin is there something else I need to do? I checked a few repos and not available in any. |
Beta Was this translation helpful? Give feedback.
-
|
Apologies @ahmedsza, this looks like to be a mistake in our docs. The feature is not yet available to public repos that are not part of an organization. We'll fix the docs as soon as possible. |
Beta Was this translation helpful? Give feedback.
-
|
Thank @charisk . Any timelines on if/when it will be available |
Beta Was this translation helpful? Give feedback.
-
|
Nothing we can share at the moment unfortunately. |
Beta Was this translation helpful? Give feedback.
-
|
thank you for the speedy responses @charisk |
Beta Was this translation helpful? Give feedback.
-
|
Fwiw, there are quite a few features that are available to organizations and not user repositories. As a non GitHub employee, I strongly encourage everyone to favor doing their work in organizations instead of in their personal account. You can create organizations for free, so you could just create one named One feature that's quite valuable is being able to view hosted runners: |
Beta Was this translation helpful? Give feedback.
-
|
Still can't overlay test coverage. 😏 |
Beta Was this translation helpful? Give feedback.
-
|
Nope, but we're working on it! :) |
Beta Was this translation helpful? Give feedback.
-
|
any updates on "Test coverage metrics"? |
Beta Was this translation helpful? Give feedback.
-
|
We're working on it and it will be available by our general availability, which we're currently targeting for June. |
Beta Was this translation helpful? Give feedback.
-
|
Wanted to test on our GHE, but doesn't worked with forked pull requests... |
Beta Was this translation helpful? Give feedback.
-
|
The new dismiss function is very cumbersome especially when it has multiple false positives. You have no click the dismiss button which opens a modal to select a reason and when you close the modal it scrolls back to the top of the PR review which causes you to lose your place with in the review. We are running into this issue multiple times when it catches a potential null reference issue even though it may have been checked at a higher level in the sequence of events/methods or even if its marked required at a model level but is leveraging nullability for other technical reasons. |
Beta Was this translation helpful? Give feedback.
-
|
Thank you for the feedback, @rstarks-aura. We will look into it.
May you provide an example? Thanks |
Beta Was this translation helpful? Give feedback.
-
|
Our initial Code Quality testing with java revealed some missing checks that we would expect from static analysis. For example try-with-resources wasn't found in a sample PR we opened. The integration between CodeQL custom queries and the Code Quality product is a bit murky. It seems like there are resource leak rules in the CodeQL repo, so we're a bit confused why we didn't get a hit. |
Beta Was this translation helpful? Give feedback.
-
|
My presumption is that this feature is limited to the core codeql bits and not custom queries, after all, the feature should enable a user to compare differing repositories using a benchmark (the code quality reports). |
Beta Was this translation helpful? Give feedback.
-
|
The CodeQL repo is a collection of all the queries that have been written/merged, but the suites that we include in the product are just a curated subset. We do not currently support custom queries/suites/packs in the code quality product, but this is something we may explore in the future. We regularly review and adjust our queries to ensure they have high coverage without being overly noisy; thank you for your feedback and we'll take this into consideration for our next update! |
Beta Was this translation helpful? Give feedback.
-
|
I've been mostly sending feedback out of band, but there are two discussions to which I have access where people are talking about this feature, and it seemed like I should share some other notes: Consider: Problems:
|
Beta Was this translation helpful? Give feedback.
-
|
Hi @jsoref , thanks for that feedback! Definitely unusual that the ghost avatar is being used 🤔 With regards to the point about AI - in the screenshot you highlighted, the finding is done via CodeQL, but the fix is generated using Copilot. We do not have an option to disable use of AI here at this time. Early in the new year, we will be unifying code quality with copilot code review, at which point all quality reviews will be presented through Copilot as a reviewer for both AI and non-AI findings. |
Beta Was this translation helpful? Give feedback.
-
|
The github-code-quality bot appears to ignore @JsonCreator(mode = JsonCreator.Mode.PROPERTIES)
public TailormapOidcUserMixin(
@SuppressWarnings("unused") @JsonProperty("claims") Map<String, Object> claims,
@SuppressWarnings("unused") @JsonProperty("authorities") Collection<? extends GrantedAuthority> authorities,
@SuppressWarnings("unused") @JsonProperty("attributes") Map<String, Object> attributes,
@SuppressWarnings("unused") @JsonProperty("nameAttributeKey") String nameAttributeKey,
@SuppressWarnings("unused") @JsonProperty("oidcRegistrationName") String oidcRegistrationName,
@SuppressWarnings("unused") @JsonProperty("additionalGroupProperties")
Collection<TailormapAdditionalProperty> additionalGroupProperties) {
// mixin constructor only for Jackson 2; no implementation
}Annoyingly it triggers again on a file after a commit to the branch (not changing the file) and even if the comments were dismissed it will generate the comments again, creating a great deal of noise, see eg. Tailormap/tailormap-api#1536 |
Beta Was this translation helpful? Give feedback.
-
|
Hi @mprins, thank you for the feedback. I see how the suppress comment functionality would be useful in these cases. We will look into prioritizing this, though please note that suppress comments are not currently supported by Code Quality. Regarding the dismiss functionality, it is unintentional that it isn't working. If I understand correctly, the finding gets dismissed but then reappears in a new comment on the next commit. We'll take a closer look to investigate. |
Beta Was this translation helpful? Give feedback.
-
|
Hey guys, I've just published an article on Medium titled "What Is GitHub Code Quality?. This is more of an intro. I'll also have a follow-up one shortly on how to set it up and configure it. I hope you find it useful! :) 
|
Beta Was this translation helpful? Give feedback.
This comment has been minimized.
This comment has been minimized.
-
|
I find this mostly useful my team has been using it for around 2 months now. However what is starting to become bother some is that we can't figure out how to disable some of the rules. If we can configure the scan the way we want we can put in restrictions etc to make this code quality metrics accurate but as is its too much false positives for us. How can I exclude some rules from the code quality scan? |
Beta Was this translation helpful? Give feedback.
-
|
We'd also like to add our other scanners to code quality rather than to code scanning where its implied to be security issues rather than just code quality. How do we do this? |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for this feedback @henriksjostrom ! We do not currently have any way to disable individual rules, though this is something we are considering for the future (no timeline yet). Similarly we do not have the ability to add other scanners to code quality at this time. |
Beta Was this translation helpful? Give feedback.
-
|
Related to disabling individual rules, I'd like to customize which files are analyzed; https://github.com/orgs/community/discussions/186446. |
Beta Was this translation helpful? Give feedback.
-
|
I see that:
However, #1210 seems to indicate GA for this; is this or not being included in GHES 3.23? |
Beta Was this translation helpful? Give feedback.
-
|
At this time, we do not plan for GitHub Code Quality to be included in GHES 3.23, and will update the roadmap issue if this changes. |
Beta Was this translation helpful? Give feedback.
-
|
Beta Was this translation helpful? Give feedback.
-
|
Thanks @carogalvin, can the ticket be updated appropriately in the roadmap? I’ve had management ask about it and point specifically to the ticket as linked. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for calling this out, I will get it fixed and remove the GHES tags. |
Beta Was this translation helpful? Give feedback.
-
|
Are there any plans to support 3rd party tools via a Sarif file (uploading them via the REST api) to use Code Quality without Copilot/CodeQL as a platform feature? |
Beta Was this translation helpful? Give feedback.
-
|
Ok, thanks for the extra information 👍🏻 |
Beta Was this translation helpful? Give feedback.
-
|
How about the case, where in a large corporation you have to use several different tools, such as for example Checkmarx One, PMD, etc. where you're supposed to use one tool to scan one language and another -- for a different? (I'm not saying that they don't overlap, but in certain cases Tool A is better at catching issues, in -- say Java with frameworks X, Y, Z, the Tool B). Many of these tools have some degree of support for SARIF2 or you have to script this out yourself. With GHAS, it's possible to upload the SARIF2 report using the |
Beta Was this translation helpful? Give feedback.
-
|
I feel like I, as a non GitHub staff, am missing something. Do you find the Code Quality UI much better than the "legacy" Code scanning endpoint (https://github.com/:owner/:repository/security/code-scanning)? https://github.com/check-spelling-sandbox/tessdoc/security/code-scanning/5797 |
Beta Was this translation helpful? Give feedback.
-
|
@jsoref thanks for the feedback on the UI. We have built the code quality UI slightly differently from the code scanning (security-focused) experience based on our research into the way devs interact with quality findings vs security alerts. However, I do acknowledge that we haven't released the perfect UX for code quality yet. In particular I am aware that it can be improved by making it easier to browse, triage and fix/dismiss larger numbers of findings. I also really appreciate the feedback that you and others have provided for us ❤️. I'm happy to say that we'll be releasing some improvements in coming weeks. |
Beta Was this translation helpful? Give feedback.
-
|
@jf205: my question was more addressed to @hfhbd + @carlspring ... certainly if you exposed the reporting endpoint publicly, I'd consider setting it up so that my tooling could use it. But I'm really wondering if there are specific reasons people would ask to have their other tools lumped into this endpoint/ux or if it's really just "we don't want people to have to use multiple different views to interact with things we think of as more or less the same". I think at the moment there are effectively three apis for submitting sarif reports (the public endpoint used by github/codeql-action/upload-sarif, the private codeql-api [which check-spelling uses because it's far superior to the endpoint used by github/upload-sarif], and presumably the new endpoint that's used for code quality). I'd be surprised if the new endpoint actually supported more features of the sarif standard (as it happens, check-spelling hasn't really needed much of the standard, although I do now have a couple of places where I could use some basic features that I haven't bothered using -- e.g. pointing to lines that led up to a problem). While Code Quality has a refreshed ui when compared to the Code Scanning Alerts, I'm not sure I've seen anything in the UI wrt actual alerts that would lead me to demand access to the upload API. |
Beta Was this translation helpful? Give feedback.
-
|
Is it possible to add instructions for GitHub Code Quality? We notice in our project that, unlike Copilot or other AI agents, GitHub Code Quality does not seem to 'listen' to any of our instructions in our See for example infonl/dimpact-zaakafhandelcomponent#5357 (review) Here the issue is in our project we use the |
Beta Was this translation helpful? Give feedback.
-
|
Hi @edgarvonk, Thanks for reaching out! While this isn’t currently on our roadmap, I’d love to learn more about your use case. Could you share a bit more about the specific types of instructions you’re looking for us to support? |
Beta Was this translation helpful? Give feedback.
-
|
Beta Was this translation helpful? Give feedback.
-
|
Yes, that is my point indeed @jsoref :-) |
Beta Was this translation helpful? Give feedback.
-
|
E.g. Copilot itself, either as PR reviewer or in our IDEs reads our AGENT.md instructions well (and also looks at how we wrote our other existing tests, depending on which mode we run the bot), but the GitHub Code Quality bot does not seem to do any of that. |
Beta Was this translation helpful? Give feedback.
This comment was marked as off-topic.
This comment was marked as off-topic.
-
|
Hello Github Family, we’ve been evaluating Code Quality internally and really like the direction, I personally enjoy the deep approach of base "code" quality and maintainability updates it offers.
Is support for custom rules (similar to: custom CodeQL queries, rule configuration, or similar extensibility) something that’s planned? This would be a big unlock for enterprise adoption on our side. Thanks 🚀 |
Beta Was this translation helpful? Give feedback.
-
|
Is there a way to run I have come up with this: I know So in the Problem: Having this workflow doesn't remove the dynamic one, and thus I don't control which one wins in terms of uploading its results. If mine wins, good results. If the dynamic one wins, bad results. (and I don't want to put in a sleep in mine to artificially delay it so it is always the latest...) The results above are trial and error based on `CODE_SCANNING_WORKFLOW_FILE There are probably bugs in here ( |
Beta Was this translation helpful? Give feedback.
-
|
So I had the exact same thought. Call the same pack, pinpoint file paths and provide the automation on trigger, push to security tab. I wanted to dabble too in custom quieries alongside "Quality" because I see a lot of noise around items not really pertaining to the env. Great file by the way. I'm a bigger fan of Advanced configs mostly for that: pinpoint "What do we need to see" not "What blob does the query result packs have today" I think the strongest suite of CodeQL is that, "Custom, Open Source and expandable" and the expansiveness is the custom side of the workflow. @kristof-mattei |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
GitHub Code Quality is now available in public preview! It turns every pull request into an opportunity to improve. With in-context findings, one-click Copilot fixes, and reliability and maintainability scores, you spend less time chasing nits and more time building. It’s there when you need it most, surfacing quality issues both in the pull request and the backlog so you can fix technical debt on your schedule.
Who this is for
Developers and engineering teams who want in‑context feedback about the quality of their code and an easier way to turn technical debt into reviewable fixes.
Highlights
How to try it
Coming soon
Availability and pricing
GitHub Code Quality is available today for GitHub Enterprise Cloud and Team, but not available on Enterprise Server. It's free during the preview period, however scans will incur Actions minutes.
Learn more
Check out our GitHub Code Quality documentation
🌟Leave a comment!
Join the discussion and leave feedback in the comments below!
Disclaimer: The UI for features in public preview is subject to change.
Beta Was this translation helpful? Give feedback.
All reactions