GitHub has added two audit-log events that help organization and enterprise administrators track when GitHub Code Quality findings are manually dismissed or reopened. Announced on October 13, 2026, the change makes these actions easier to review after the fact instead of relying only on a finding’s current status or a developer’s explanation.

The new events are:

  • `repo.code_quality_findings_dismissed` — records the dismissal of one or more Code Quality backlog findings.
  • `repo.code_quality_findings_reopened` — records the reopening of one or more backlog findings.

GitHub says each event includes information about who made the request, when it happened, the repository and rule involved, and identifiers and counts for the affected findings. The events are generally available for GitHub Team and GitHub Enterprise Cloud, including enterprises with data residency. They are not available on GitHub Enterprise Server. For repositories where Code Quality is already enabled, GitHub says no additional setup is required to record these actions in the audit log.

This guide explains how to locate the new events, filter them, interpret the available details, and use them in a practical review process. The goal is not to discourage legitimate dismissals. It is to make decisions about code-quality findings traceable, reviewable, and easier to investigate.

What Changed in GitHub Code Quality Audit Logs?

GitHub Code Quality identifies issues that can affect the reliability and maintainability of a codebase. Depending on the workflow, findings can appear in a repository’s default-branch backlog or in pull requests. Teams may fix a finding, apply an appropriate autofix, delegate remediation to Copilot where available, or dismiss a finding that is not relevant or actionable.

Dismissal is a legitimate part of maintaining a finding backlog. For example, a team might determine that a reported pattern is an accepted exception, that a finding is a false positive, or that a legacy component is outside the scope of a particular remediation effort. The important operational question is whether the decision can be explained later.

Before this update, an administrator investigating a change could need to reconstruct the context from the current state, pull-request discussions, or other records. The new events provide explicit audit-log entries for manual dismissals and reopenings of Code Quality backlog findings.

The two event names are exact identifiers, so use them rather than a broad search for the words “dismissed” or “reopened.” GitHub’s announcement says the records include the actor, timestamp, repository, rule, affected finding identifiers, and finding count. These fields can help answer practical questions such as:

  • Who dismissed or reopened the findings?
  • When did the action take place?
  • Which repository and Code Quality rule were involved?
  • How many findings were affected?
  • Which finding identifiers should be reviewed in the Code Quality interface?

The audit log is an accountability record, not a complete explanation of intent. An event can show that an action occurred and identify the related details, but it does not necessarily explain why the person made the decision. For that, reviewers may still need a pull request, issue, team discussion, change request, or other supporting context.

Who Can Use the New Events?

GitHub announced general availability for GitHub Team and GitHub Enterprise Cloud, including enterprises that use data residency. The update is not available on GitHub Enterprise Server.

There are two important prerequisites to distinguish:

  1. Code Quality must be enabled for the relevant repository. The new events concern Code Quality findings; they are not a general audit trail for every kind of code review or security alert.
  2. You need access to the relevant audit log. Organization audit logs are restricted to organization owners. Enterprise audit-log access depends on your enterprise role and configuration.

If you are a developer without organization-owner or appropriate enterprise permissions, you may be able to review a finding in the repository but not search the organization’s audit log. Ask an authorized owner or administrator to run the search or provide the relevant audit record according to your organization’s process. Do not attempt to work around the access controls.

The new events do not require a separate setup step for repositories that already have Code Quality enabled, according to GitHub’s announcement. If an expected event is missing, check eligibility, access, the date range, and whether the action was actually a dismissal or reopening before assuming the feature is malfunctioning.

Step 1: Open Your Organization’s Audit Log

To review organization-level events, use GitHub’s web interface:

  1. Sign in to GitHub using the account that has the required administrative access.
  2. Open the organization that owns the repository.
  3. Select Settings. Depending on the interface, you may need to open the organization menu first.
  4. In the settings sidebar, find the Archive section.
  5. Select Logs, then open Audit log.

GitHub can change menu labels or placement over time, so if the path differs in your account, use the current official guide, Reviewing the audit log for your organization.

For an enterprise-level investigation, open the enterprise’s audit log using an account with the required enterprise permissions. Choose the organization log when you are investigating activity scoped to a specific organization; use the enterprise log when your review needs the broader enterprise view and your access permits it.

The organization audit log is intended to show actions affecting the organization. GitHub’s documentation states that it retains organization audit-log events for 180 days, with a shorter default view unless you specify a date range. This makes it important to run investigations promptly and export relevant records when your internal retention or compliance process requires them.

Step 2: Filter for Dismissed Findings

The first event to search for is:

```text repo.code_quality_findings_dismissed ```

GitHub’s changelog instructs administrators to filter the audit log by the action names. In the audit-log search interface, use the action filter or query syntax supported by the current interface. For example, start with the event name itself as the action value:

```text action:repo.code_quality_findings_dismissed ```

If the interface presents a dedicated action filter instead of accepting the query exactly as shown, enter the same event identifier in that filter. The event name is the key; do not substitute a general phrase such as “Code Quality dismissal,” which may not match the event category.

Once results appear, review the timestamp, actor, repository, rule, finding count, and finding identifiers where provided. If your organization manages many repositories, narrow the search to a specific repository or time range using the qualifiers supported by GitHub’s audit-log search.

For example, GitHub documents the use of repository and date qualifiers in audit-log queries. A query can be narrowed to one repository and a period under investigation:

```text action:repo.code_quality_findings_dismissed repo:YOUR-ORG/YOUR-REPOSITORY ```

Replace the sample organization and repository with the real values. Do not paste a placeholder query into a compliance report and treat it as evidence. Record the actual query, account context, and time range used for the investigation so another authorized reviewer can reproduce it.

What should you look for?

A dismissal is not automatically suspicious. Look for patterns that matter in your environment, such as an unusually large number of findings dismissed at once, repeated dismissals under the same rule, activity that coincides with a release deadline, or a dismissal in a repository that is subject to stricter review requirements.

Use the event to identify the action, then inspect the underlying finding and surrounding context. The log helps you locate the decision; it does not replace technical judgment about whether the finding was valid or whether the dismissal was appropriate.

Step 3: Search for Reopened Findings

The second event is:

```text repo.code_quality_findings_reopened ```

You can use the corresponding action filter:

```text action:repo.code_quality_findings_reopened ```

Reopening can be a positive sign. A team may revisit a previous decision after learning more about a code path, changing a coding standard, or discovering that an earlier dismissal no longer applies. The audit event helps reviewers establish when the reopening occurred and which findings were affected.

During an investigation, compare reopening events with prior dismissal events when both are available. Check whether the same finding identifier appears, whether the rule and repository match, and whether a code change or policy decision provides context. Avoid assuming that every reopening corresponds to a particular earlier dismissal unless the event details establish that relationship.

A reopened finding should be reviewed through the normal Code Quality workflow. Determine whether the issue needs a fix, an autofix review, a Copilot-assisted remediation, or another documented resolution. If the finding is dismissed again, the second action should also be traceable through the appropriate audit record.

Step 4: Investigate the Finding in Context

Audit logs are most useful when paired with the Code Quality interface. After identifying the repository and finding identifiers, open the relevant repository and navigate to its Security and quality area, then the Code Quality findings view. The exact page and available views can differ depending on whether the finding belongs to the default-branch backlog or a pull request.

Use the finding’s rule, severity, file location, and explanation to understand what was reported. Check the suggested fix and supporting references where available. If the finding was dismissed, determine whether the reason was a false positive, an intentional coding pattern, a legacy exception, or another documented decision.

GitHub’s guide to fixing Code Quality findings in a repository backlog explains how to review standard findings, apply fixes, delegate remediation to Copilot where supported, and dismiss findings that are not relevant or actionable.

For findings on a pull request, use the appropriate pull-request workflow and review the comments or suggested changes. The new audit events announced by GitHub specifically describe dismissals and reopenings of backlog findings, so do not assume that every action on a pull-request finding necessarily produces one of these exact event types. Confirm the event scope in GitHub’s current documentation.

Step 5: Export Evidence for a Review

For a one-off investigation, the audit-log web interface may be enough. For a broader review, use GitHub’s export function after narrowing the query to the relevant activity.

A practical export workflow is:

  1. Filter by the exact event name.
  2. Restrict the date range to the incident, release, or review period.
  3. Add a repository filter if the investigation is repository-specific.
  4. Review a sample of the results in the interface before exporting.
  5. Export the filtered records in a supported format, such as JSON or CSV.
  6. Store the export in the approved location for audit evidence, following your organization’s retention and access rules.

Avoid exporting an unnecessarily broad dataset. GitHub documents limits on audit-log exports, so smaller, well-scoped searches are easier to handle and review. The export should preserve the original event details. If you transform the data for a report, keep the original export and document the transformation.

For automated retrieval, GitHub Enterprise Cloud supports audit-log access through the audit-log API. Administrators can use the official audit-log documentation to confirm the current API method, required permissions, and available fields. The new events are also available through the audit log API on GitHub Enterprise Cloud, according to the announcement.

Do not assume that the same API capabilities are available on GitHub Enterprise Server. GitHub explicitly states that this improvement is not available on that product.

Step 6: Build a Repeatable Review Process

The audit-log update is most valuable when it becomes part of a consistent process rather than a search that happens only after a problem.

A lightweight review process can include these steps:

  • Define ownership. Decide which organization owners, security leads, or repository maintainers review dismissal and reopening activity.
  • Document acceptable reasons. Give developers a clear way to record why a finding was dismissed, such as a false positive, a documented exception, or a finding that does not apply to the code path.
  • Review unusual patterns. Focus on large batches, repeated dismissals for the same rule, or activity in sensitive repositories.
  • Link evidence to the decision. Where appropriate, retain a ticket, pull request, or review note that explains the technical reason.
  • Revisit reopened findings. Make sure reopening leads to a clear next step instead of leaving the finding unresolved indefinitely.
  • Keep access limited. Audit exports can contain user and repository activity. Store them only where authorized reviewers can access them.
  • Recheck the process periodically. Confirm that the team still uses the current event names, supported filters, and product capabilities.

These are operational recommendations, not additional features that GitHub automatically enforces. The audit event improves visibility, but the organization remains responsible for defining review criteria and acting on what the records show.

Example: Reviewing a Batch of Dismissals

Imagine that an administrator notices a sudden decrease in open Code Quality backlog findings in a repository that is preparing for a release. The dashboard alone may show fewer open findings, but it may not fully explain whether the decrease resulted from code fixes, dismissals, or a combination of actions.

The administrator filters the audit log for `repo.code_quality_findings_dismissed`, narrows the results to the repository and release window, and finds a batch dismissal associated with a particular rule. The record identifies the actor, timestamp, repository, rule, and affected findings.

The administrator then opens the relevant Code Quality findings and checks the files and rule explanation. If the dismissal was based on an accepted exception, the team’s documented rationale can help confirm that the decision was intentional. If the reason is unclear, the administrator can ask the responsible maintainer to explain the decision and document the outcome.

Now imagine that some of those findings are reopened later. The administrator searches for `repo.code_quality_findings_reopened` and compares the new records with the earlier review. The team can determine whether new information changed the assessment and whether the reopened findings have an owner and remediation plan.

This workflow does not treat dismissals as misconduct. It creates a way to distinguish a justified decision from an unexplained change and to make the next review more efficient.

Common Problems and How to Troubleshoot Them

No results appear for the event name

First, verify that you used the exact event identifier. Check the time range, the organization or enterprise audit log you opened, and the repository filter. Confirm that the relevant repository has Code Quality enabled and that your account can view the audit log.

The announcement is dated October 13, 2026. If you are investigating an earlier period, do not assume the new event types will reconstruct historical actions that occurred before the feature was available. Review the current documentation and the event timestamps.

The query works for one repository but not another

Check whether Code Quality is enabled on the second repository and whether the action took place in the organization you are searching. A repository name alone may be insufficient if the query syntax requires the organization and repository together. Verify the exact repository owner and name before broadening the search.

The audit record does not explain why a finding was dismissed

The event records action details, but it is not guaranteed to contain a full narrative justification. Review the finding itself and look for relevant pull requests, issues, or internal review records. If your organization wants better explanations for future decisions, define a team process for recording the rationale alongside the action.

An administrator cannot access the organization audit log

GitHub’s documentation says only organization owners can access the organization audit log. Ask an authorized owner to run the query or review whether your role has the appropriate enterprise-level access. Do not attempt to bypass the organization’s permission model.

You use GitHub Enterprise Server

GitHub states that this improvement is not available on GitHub Enterprise Server. Confirm your product and deployment type before following the steps. Do not assume that an event available on GitHub Enterprise Cloud is also present in a self-hosted Enterprise Server installation.

A finding was fixed, not dismissed

The new events are about manual dismissals and reopenings of backlog findings. A fix, a merged change, or another status transition may not generate either of these specific events. Use the relevant Code Quality interface and other available records to investigate the action that actually occurred.

Frequently Asked Questions

What are the new GitHub Code Quality audit-log events?

The new events are `repo.code_quality_findings_dismissed` and `repo.code_quality_findings_reopened`. They record manual dismissals and reopenings of one or more Code Quality backlog findings.

Do I need to enable a separate setting?

GitHub says no additional setup is needed for repositories that already have Code Quality enabled. You still need access to the relevant organization or enterprise audit log to review the events.

Which GitHub plans support these events?

GitHub announced general availability for GitHub Team and GitHub Enterprise Cloud, including enterprises with data residency. The improvement is not available on GitHub Enterprise Server.

Can I use the audit-log API?

Yes, the announcement says these events can also be retrieved through the audit-log API on GitHub Enterprise Cloud. Check the current official documentation for API permissions and query details.

Does a dismissal mean the finding was false?

No. A dismissal means a user chose to dismiss the finding; it does not, by itself, prove that the finding was a false positive. Review the technical context and any documented rationale before drawing a conclusion.

Will these events show every Code Quality change?

No. The new events specifically concern manual dismissals and reopenings of backlog findings. Do not assume that they record fixes, all pull-request activity, or every change in a finding’s state.

Final Checklist

Before closing an audit review, confirm that you:

  • Used the exact event name and the correct organization or enterprise audit log.
  • Applied a date range and repository filter that match the investigation.
  • Checked the actor, timestamp, rule, and finding identifiers in the returned records.
  • Reviewed the underlying finding rather than relying on the audit event alone.
  • Recorded the rationale or follow-up where your organization’s process requires it.
  • Exported only the necessary evidence and stored it in an approved location.
  • Confirmed that your GitHub product supports the feature.

The new GitHub Code Quality events give administrators a more direct way to investigate manual dismissal and reopening activity. They do not replace technical review or explain every decision automatically, but they make the trail easier to find. Combine the event record with the finding’s context and a clear review process to make code-quality decisions more transparent and reproducible.

Official Sources