GitHub Ships a Separate Actions Path for Code Quality

What shipped? GitHub Code Quality analysis runs now use a dedicated Actions workflow path, splitting it from the code scanning pipeline.

What changed? Code Quality analysis now runs on dynamic/github-code-quality/codeql with github-code-quality as the actor, instead of sharing dynamic/github-code-scanning/codeql and the github-advanced-security actor with code scanning. Three new audit log events also shipped: repo.code_quality_enabled, repo.code_quality_disabled, and repo.code_quality_updated — each capturing the repo, actor, and timestamp of the change.

Why does a builder care? If you track Actions usage or billing by workflow path, your filters broke yesterday without telling you. Update any scripts or dashboards that identify Code Quality runs by the old github-advanced-security actor or dynamic/github-code-scanning/codeql path — they'll miss the new runs. On the upside: the audit log events let you pin down when a repo entered or left Code Quality billing scope, which is useful for cost attribution at scale.