AI
The Speed-Quality Tension in AI-Assisted Development
AI lets GitHub’s secrets-protection team ship more secret validators per quarter than was possible before. That speed is real. But code review is the turn that tests whether you can hold it. Push too hard and bugs reach production, customers lose trust, and revenue takes the hit. Slow the review process down and you waste everything AI gave you. GitHub’s position is that this is a false trade-off: code should be secure and high quality by default, regardless of whether a developer or an AI agent wrote it.
GitHub Code Quality: What Ships Today
GitHub Code Quality launched in public preview at GitHub Universe 2025. It runs two detection engines on every repository: CodeQL for structured, deterministic static analysis tagged by reliability or maintainability severity, and an LLM layer for findings CodeQL does not reach. One-click enablement at the repository level gets it running immediately. Auto-fix works across both engines. Test coverage, org-level rollout controls, trend reporting, and Copilot policy integrations are on the roadmap.
Pull Request Enforcement in the Demo
The demo uses a fictional F1 analytics firm called Rev Linux. A developer opens a PR for a new fuel-usage panel, and the pull request quality gate demo (12:52) shows Code Quality bot already waiting with two findings: an unused assigned value and a duplicate function declaration that would not run. The bot includes fix recommendations inline. The developer commits one directly from the PR interface and watches the check rerun. Merge is blocked by a ruleset until all findings clear.
Clearing Legacy Debt with the AI Findings Page
Under the Security tab, an experimental AI findings page lists LLM-detected problems across the five most recently changed files. One file named legacy_quality_debt has 25 problems. From the AI findings page and Copilot Coding Agent assignment (15:29), a developer can assign every problem in the file to Copilot Coding Agent with one click. The CodeQL findings page works alongside it, scoring repos on reliability and maintainability. Fixing two error-level findings (assignment to a constant) moved the reliability score from “needs improvement” to “good”.
Private Preview Results and What Is Coming Next
In private preview, 50 customers deployed the tool to 300 repositories and turned up 88,000 quality issues, an average of 271 findings per repository. An org-level dashboard is coming in the next few months, showing reliability, maintainability, and test coverage scores side by side for every repo in the portfolio. Bulk assignment of all findings to Copilot is also on the roadmap. GitHub Code Quality is free in public preview today; design partners can sign up to influence the roadmap.
Notable Quotes
Speed without control can be dangerous. Marcelo Oliveira · ▶ 1:26
whether you are working on security or quality in GitHub found means fixed. Caro Galvin · ▶ 10:50
I must have written this code before I had my coffee this morning. Caro Galvin · ▶ 14:16
Key Takeaways
- GitHub Code Quality (public preview) catches maintainability and reliability issues at the PR level using CodeQL plus LLM detection.
- 50 private-preview customers across 300 repos uncovered 88,000 quality issues, averaging 271 findings per repository.
- Copilot Coding Agent can be assigned an entire file’s worth of legacy debt fixes in one click, freeing developers to work on other things.