feat(catalog): model GitHub Code Quality as its own billing tier - #49
Merged
Conversation
Code Quality existed only as the product-fact github-code-quality-transition: priced in the ledger, absent from the capability catalog and every tier doc. Re-verification against the billing docs on 2026-08-01 established that repository visibility does not gate the licence — a public repository is billed the same per-active-committer rate as a private one, and being public only removes the Actions-minutes component. That contradicted the docs/01-public-oss-free.md promise of the entire suite for free. The three-tier model sorts by visibility and plan; this product obeys neither, so it is documented as an orthogonal fourth tier and excluded from both free tiers, which name their free maintainability substitutes instead. Also records that committers are counted once per organization (so a few-paid-repos split saves nothing unless committer sets differ) and that the licence is independent of Code Security and Secret Protection. The capability carries workflow: null and example: null because Code Quality has no Action, no workflow_call entrypoint, and no REST or GraphQL API: enablement is UI-only and cannot be pinned, asserted, or drift-checked from CI. The merge gate is documented as a UI procedure for the same reason. Signed-off-by: rldyourmnd <danil@nddev.it.com>
The tier docs reasoned from GitHub's price list, so a private NDDev repo was configured as if it were on the free plan while the organization already paid for Enterprise Cloud, Code Security, Secret Protection, and Code Quality. Concrete loss this closes: 02-private-free routes private releases to release-supply-chain-free.yml because Artifact Attestations require Enterprise Cloud on private repos. This estate has Enterprise Cloud, so all 26 private repositories were emitting slsa_build_level: null and discarding provenance that was already bought. Records that these products bill per active committer counted once per organization, so with one committer the estate pays the same whether one repository or fifty are enabled. States absences too: Copilot Autofix unavailable (zero seats assigned), and sha_pinning_required is false at both org and enterprise -- flagged rather than recommended, since enabling it org-wide would break tag-pinned repositories. Signed-off-by: rldyourmnd <danil@nddev.it.com>
…plit Push protection was disabled across the estate as a velocity trade-off, so the tier doc no longer claims it. States the consequence plainly: detection is now after the fact, and a secret-scanning alert means an already-leaked credential. Also records why code scanning is enabled per repository rather than by the configuration: attachment is atomic, so forcing default setup where an active CodeQL advanced setup exists fails the whole attachment and takes secret scanning with it. Coverage is 50/50 -- 30 default setup, 20 own workflow. Signed-off-by: rldyourmnd <danil@nddev.it.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
GitHub Code Qualityexisted in this repo only as the product-factgithub-code-quality-transition— priced in the ledger, absent from thecapability catalog and from every tier doc. This models it properly: catalog
entry
github-code-qualityplus a tier doc,docs/16-code-quality.md.It is deliberately not folded into the public tier. Re-verification against
the billing docs on 2026-08-01 established that repository visibility does not
gate the licence: a public repo is billed the same per-active-committer rate as
a private one, and being public only removes the Actions-minutes component.
That contradicted
docs/01-public-oss-free.md, which promised the "entiresecurity and supply-chain suite for free" — false for anyone who enabled Code
Quality on a public repo.
Two further facts are recorded because they invert the usual cost-control
instinct: committers are counted once per organization (so a "few paid
repos, many free repos" split saves nothing unless the committer sets differ),
and the licence is independent of Code Security / Secret Protection.
The capability carries
workflow: null/example: null— the honest shape,not a gap: Code Quality has no Action, no
workflow_callentrypoint, and noREST or GraphQL API, so enablement is UI-only and cannot be pinned by SHA,
asserted, or drift-checked from CI. The merge gate (ruleset rule "Require code
quality results", severity threshold, check
CodeQL - Code Quality) isdocumented as a UI procedure and not encoded in
.github/rulesets/,because those specs are shaped for
POST /repos/{owner}/{repo}/rulesetsandthis rule's type identifier is undocumented.
Type of change
Threat-model note (required for workflow / permission changes)
N/A — docs only. No workflow file, token scope, egress path, or action
reference is touched;
git diff --name-onlycoversAGENTS.md,README.md,CHANGELOG.md,catalog/, anddocs/only.Permissions diff (required for workflow / permission changes)
N/A — docs only. No job
permissions:block changes.Checklist
# vX.Y.Zversion comment (no tags/branches). — unchanged;pinned-actionsOKpermissions(top-level{}, per-job minimal scopes). — unchanged;permissionsOKconcurrencyandtimeout-minutespresent on new/changed workflows/jobs. — no workflows changedpersist-credentials: falseon all read-onlyactions/checkoutsteps. — unchanged${{ inputs.* }}/${{ github.event.* }}interpolated insiderun:. — unchangedharden-runner-contractOKactionlintpasses locally. — not run: binary not installed in this environment. No workflow YAML changed, so it has nothing new to lint;workflow-contractsandactionlint-contractboth pass invalidate_all.py.zizmor --pedanticpasses locally. — not run: binary not installed in this environment. Same rationale:.github/workflows/is byte-identical tomain.docs//catalog/updated.CHANGELOG.mdupdated under[Unreleased].-S) and signed off (-s, DCO); Conventional Commitmessages. — DCO sign-off and Conventional Commit: yes. Cryptographic
-Ssignature: NO — no signing key is configured in this environment. Therequired_signaturesrule onmainwill reject this as-is; the maintainer must re-sign (git commit --amend -S) before merge.Tier impact
Verification
python3 scripts/validate_all.py— 18/18 OK (pinned-actions, tool-pinning,permissions, workflow-contracts, harden-runner-contract, release-supply-chain,
monorepo-routing, benchmark-contract, actionlint-contract, examples, docs-links,
merge-group, rulesets, catalog, product-facts, runtime-coverage, skills,
generated-docs).
docs/generated/*regenerated viascripts/generate_docs.py.