GitHub Adds Code Quality Finding Audits for Dismissals
Organizations and enterprises using GitHub can now review manual dismissals and reopenings of Code Quality findings through their logs.
Radwan AbdulhadiEditor and technology writer
Introduction to Code Quality Finding Audits
GitHub has announced a new capability allowing development and security teams to review manual dismissals and reopenings of GitHub Code Quality findings directly within their organization audit log or enterprise audit log. These findings may appear in either a repository’s default-branch backlog or pull requests, providing teams with multiple pathways for identifying and addressing technical debt and code standard issues. According to the official [GitHub Changelog](https://github.blog/changelog/2026-10-13-audit-github-code-quality-finding-dismissals-and-reopenings/), this update aims to improve transparency and traceability across software development lifecycles by ensuring that management teams can track how code quality issues are handled over time.
Maintaining rigorous code quality standards often involves examining why certain alerts or findings are dismissed or reactivated by developers. With this release, administrators no longer have to rely on informal tracking or guesswork when reviewing repository backlogs. Instead, they can systematically monitor these changes using native logging tools that integrate smoothly into existing administrative workflows. This addition helps organizations maintain compliance, enforce internal governance rules, and better understand developer interactions with code quality metrics across distributed teams and complex project structures.
New Audit Events and Log Structure
To support this functionality, GitHub has introduced two distinct new events designed to record specific user actions within a repository. The first event, repo.code_quality_findings_dismissed, records when one or more backlog findings are manually dismissed by a user. The second event, repo.code_quality_findings_reopened, records when previously dismissed backlog findings are reactivated or reopened for review. Each recorded event contains comprehensive metadata, capturing who made the request, the exact time the action occurred, the relevant repository, the associated rule, and the specific identifiers and count of the affected findings.
For administrators seeking to query or review this information, the process is straightforward and leverages existing platform infrastructure. If an organization has repositories with Code Quality enabled, no additional setup is required. Administrators who have access to their organization audit log can simply filter by these specific action names to review recent activity. Similarly, enterprise administrators can utilize the enterprise audit log to monitor actions across multiple organizations under their management scope.
API Support and Platform Availability
Beyond manual dashboard reviews, GitHub has ensured that automated systems and custom scripts can also access these logging events. On GitHub Enterprise Cloud, administrators can retrieve these events programmatically through the audit log API. This capability enables teams to build custom monitoring solutions, integrate audit data with external security information and event management systems, or generate automated reports regarding code quality management practices across their enterprise environments.
In terms of platform availability, this improvement is generally available on GitHub Team and GitHub Enterprise Cloud, which includes enterprises utilizing data residency features. However, it is important for systems administrators to note that the feature is currently not available on GitHub Enterprise Server installations. Teams working within cloud-hosted environments can begin utilizing these logging features immediately without waiting for major software upgrades or performing manual database migrations.
Managing Repository Backlogs and Best Practices
Tracking dismissals and reopenings is part of a broader strategy for maintaining clean, secure, and maintainable codebases. When developers handle code quality warnings, understanding the context behind a dismissal helps teams refine their linting rules and coding standards. For further details on how to handle and resolve these items, developers and maintainers can consult the official documentation on [Fixing code quality findings in your repository backlog](https://docs.github.code-security/how-tos/maintain-quality-code/fix-backlog-findings). Proper backlog management ensures that genuine issues are not prematurely dismissed while reducing noise from false positives.
Organizations looking to discuss these changes, share implementation tips, or provide feedback to the platform engineers can participate in community discussions. Developers frequently share insights and best practices via the [GitHub Community discussion](https://github.org/orgs/community/discussions/201460) channels, which serve as a valuable resource for teams adapting to new security and code quality features.
Broader Security and Governance Updates
The introduction of code quality finding audit logs arrives alongside several other platform enhancements aimed at strengthening application security and platform governance. For instance, GitHub has updated its secret scanning capabilities to block Anthropic keys by default while also adding support for Salesforce tokens, as detailed in recent updates regarding [Secret scanning blocks Anthropic keys by default, adds Salesforce](https://github.blog/changelog/2026-10-13-secret-scanning-blocks-anthropic-keys-by-default-adds-salesforce). These continuous security improvements underscore GitHub's commitment to providing robust tooling for modern development teams.
Additionally, security teams can now evaluate [Code scanning AI Scan metrics in security overview](https://github.blog/changelog/2026-10-13-code-scanning-ai-scan-metrics-in-security-overview) to gain deeper visibility into automated scanning performance. Together, these updates across audit logging, secret protection, and code quality management provide enterprise organizations with comprehensive oversight over their software development lifecycle and security posture.
Sources
- GitHub ChangelogAudit GitHub Code Quality finding dismissals and reopenings
Continue chronologically
Related entity coverage
Related stories
GitHub Adds REST API Control for Code Coverage Rules
GitHub now lets teams manage the Restrict code coverage repository ruleset through its generally available REST API.
GitHub Code Coverage Updates CI Uploads for New Branches
GitHub updates its Code Quality upload-code-coverage action so code coverage uploads no longer fail CI for new branches without open pull requests.
GitHub Adds CSV Download for Code Quality License Usage
GitHub introduces a new CSV report feature for GitHub Code Quality license usage, allowing teams to reconcile license counts and optimize costs.
GitHub Actions to Block pull_request_target by Default
GitHub Actions will block pull_request_target events by default in public repositories starting December 2, 2026, enhancing security.
