For platform administrators, the update closes a practical visibility gap: instead of staring at a top-level consumed license counter on the Code Quality card and guessing which repository triggered a seat charge, you can now export the underlying committer-to-repository mapping and make informed decisions before the next billing cycle rolls around.
What the New Code Quality License CSV Contains
According to the GitHub Changelog announcement, the downloadable CSV report captures three specific data points designed for license reconciliation and optimization:
- Active license-consuming committers: Every active committer who currently consumes a GitHub Code Quality license.
- 90-day repository activity: The specific repositories that received commits from each listed committer over the last 90 days.
- Uniqueness indicators: Whether each committer is unique to a single repository or a single organization.
That third item—whether a committer is unique to one repository or organization—is the operational linchpin of the export. In a large engineering org, a single developer might push code to a dozen repositories where Code Quality is enabled; disabling the feature on just one of those repositories will not free up that developer's seat because the remaining eleven repositories still keep them active. Conversely, if a contractor, a legacy service team, or a drive-by contributor only committed to a single repository with Code Quality enabled, the uniqueness indicator makes that seat stand out immediately.
How to Download the CSV Report
GitHub has placed the export directly inside the existing billing administration workflow. To retrieve the file:
- Navigate to the Billing and licensing page for your organization or enterprise.
- Open the Licensing section.
- Locate the Code Quality card and download the CSV report.
Per GitHub's announcement, this CSV export is available to customers running on GitHub Team and GitHub Enterprise Cloud.
Section Summary: The new CSV export lists active committers, their repositories with commits in the last 90 days, and whether their seat consumption is isolated to a single repository or organization, accessible directly from the Code Quality card under Licensing on GitHub Team and Enterprise Cloud.
Why the "Unique Committer" Distinction Matters for Next Month's Bill
Anyone who has ever flipped off a cloud feature mid-month expecting an instant credit knows the sting of billing-cycle physics. GitHub is explicit about how seat reclamation works here: using the unique committer details from the CSV helps you identify where disabling Code Quality can free up licenses for the next billing period, without changing your current license charge.
According to GitHub Docs' guide on viewing and managing GitHub Code Quality costs, turning off Code Quality on a low-value repository has an immediate operational effect alongside a delayed license effect:
- Immediate effect: Disabling Code Quality on a repository stops its scans and its AI usage right away.
- Next-period effect: It can free up licenses for the next billing period for committers who were unique to that repository, though it does not reduce the license charge for the current billing period.
Think of it as canceling a gym membership after your monthly dues have already cleared the bank—you stop using the treadmills immediately, and your wallet feels the relief on the first of next month. By running the CSV audit before a billing period closes, DevOps and FinOps teams can spot isolated repositories—such as experimental sandboxes, archived documentation repos, or minor internal tools—where a handful of unique committers are unintentionally locking in per-committer license fees.
The Bigger Picture: Licenses Are Only One of Three Cost Levers
While the new CSV is essential for auditing who holds a seat, IT administrators should remember that reconciling committers is not the same thing as reconciling your entire Code Quality invoice. As detailed in GitHub Docs' GitHub Code Quality billing and cost-management documentation, Code Quality is a standalone product with its own license (separate from GitHub Advanced Security), and its total spend across an organization comes from three distinct buckets:
| Cost Category | How It Is Measured | Where to Track and Reconcile It |
|---|---|---|
| License Usage | Per-seat fee based on unique, active committers to repositories where Code Quality is enabled. | Code Quality license CSV on the Licensing page (for committer and repo attribution). |
| GitHub Actions Minutes | Consumed each time a deterministic CodeQL scan runs as a GitHub Actions workflow, unless you use self-hosted runners. | Billing usage report on the Billing and licensing tab (the only place to attribute spend and Actions minutes down to a specific repository or organization). |
| GitHub AI Credits | Consumed by AI-powered features, including generated autofixes for findings in pull requests and on the default branch, and scans on the optional AI findings page. | AI usage page grouped by Product (tracks Code Quality's draw from the shared enterprise or organization AI credits pool). |
Understanding how these three buckets interact prevents nasty surprises at scale. According to GitHub Docs, your per-committer license charge is separate from and unaffected by AI credits usage. However, Code Quality draws its AI credits from the same shared billing-entity pool used by other AI products like GitHub Copilot. Furthermore, while the public-preview AI findings page is off by default and can be toggled off in repository settings, the in-pull-request AI features (which generate a fix for every detected finding) cannot be turned off independently. If you want to stop a repository from consuming AI credits on pull requests entirely, you have to either enforce a SKU-level or AI-credits budget (which acts as a mandatory hard stop once reached) or disable Code Quality on that repository altogether.
That architectural reality makes the new committer CSV doubly useful. When you cross-reference the billing usage report (which shows which repositories are burning through Actions minutes and overall spend) with the new Code Quality license CSV (which shows whether the committers on those repositories are unique), you get a complete decision matrix. You can see both what a repository costs to scan and how many per-committer seats would actually drop off next month's bill if you turned Code Quality off on it.
Section Summary: Code Quality costs span per-committer licenses, GitHub Actions minutes, and shared GitHub AI Credits. Pairing the new license-usage CSV with the broader billing usage report and AI usage page gives administrators complete visibility across seats, compute, and AI consumption.
Practical Reconciliation Checklist for GitHub Admins
If your organization or enterprise has rolled out GitHub Code Quality—or is currently piloting it across select teams—here is a straightforward workflow to put the new CSV report to work:
- Pull the license CSV before your billing cycle resets: Head to Billing and licensing > Licensing and download the CSV from the Code Quality card on your GitHub Team or GitHub Enterprise Cloud account.
- Filter for unique committers first: Sort or filter the spreadsheet by the uniqueness column to isolate committers tied to a single repository or organization over the past 90 days.
- Audit repository value against seat count: Check whether the repositories holding unique committers are production-critical codebases or low-priority projects where deterministic CodeQL scans and AI autofixes aren't justifying the per-committer seat cost.
- Cross-check Actions and AI spend: If a repository has shared committers (meaning disabling it won't free up licenses), check the billing usage report and AI usage page before dismissing it—disabling Code Quality on a noisy repository still stops its GitHub Actions scan minutes and AI credit draw immediately.
- Disable selectively ahead of the cutoff: Where Code Quality isn't adding sufficient value, disable it on those repositories now so the unique committer licenses are freed for the upcoming billing period.
By giving administrators a clean CSV export of active committers, their 90-day repository footprint, and their uniqueness status, GitHub has turned Code Quality license reconciliation from a guessing game into a five-minute spreadsheet pivot.