Platform engineering and DevSecOps practitioners now have a mechanism to observe changes in GitHub Code Quality configurations directly within their organization audit logs. Previously, the lack of granular events for this specific feature made it difficult to reconcile which repositories were actively generating costs versus those that remained disabled.
New Audit Events
GitHub has added three distinct event types to its logging infrastructure:
- repo.code_quality_enabled: Records the moment a repository enters Code Quality scope, triggering billing based on active committers.
- repo.code_quality_disabled: Captures when an administrator turns off analysis for a specific repo.
- repo.code_quality_updated: Logs configuration changes made to repositories that already have the feature enabled.
These events capture the repository identifier, the actor responsible for the change, and the timestamp. They are available in both organization-level audit logs on GitHub Enterprise Cloud (including data residency) and enterprise instances via Team plans.
Governance Implications
The primary operational impact is improved cost attribution and compliance verification. By querying these events through the Audit Log API, security teams can now definitively prove when a repository entered or left the billing scope for AI code analysis. This visibility prevents ambiguity regarding whether an organization was charged for unused features.
What This Means For Practitioners
To maintain accurate cost tracking and governance posture, platform engineers should integrate queries against these new event types into their existing audit monitoring pipelines. When reviewing billing reports or investigating unauthorized configuration changes, check the security pillar for guidance on auditing access controls alongside this specific feature's enablement history.