GitHub Actions Splits Code Quality and Security Paths for Granular CI/CD Observability

GitHub has made generally available a dedicated workflow path and distinct actor identity for GitHub Code Quality CodeQL workflows in GitHub Actions. Specifically, Code Quality analysis now executes under the workflow path dynamic/github-code-quality/codeql and reports github-code-quality as its triggering actor. Previously, these automated analysis runs shared the dynamic/github-code-scanning/codeql path and were grouped under the generic github-advanced-security actor alongside standard security code scanning jobs. This separation addresses an operational visibility friction for DevOps and platform engineering teams. When security vulnerability detection and code maintainability checks share identical workflow metadata and actor credentials, tracking consumption and triaging pipeline events becomes cumbersome. Differentiating these two domains at the workflow run history and telemetry layer gives organizations clear visibility into which jobs stem from automated code health assessments versus dedicated vulnerability scans. This granularity directly impacts cost allocation, enabling finance and platform leads to track GitHub Actions minutes consumed by quality evaluations without muddying security compliance metrics. The shift aligns with a broader industry-wide movement toward granular CI/CD observability and least-privilege automation accounting. As modern software delivery platforms incorporate more integrated static analysis, AI-driven refactoring, and automated review tooling directly into the pull request cycle, overloaded generic service identities become a governance bottleneck. Engineering organizations increasingly mandate clear provenance and distinct machine actors across their pipelines to satisfy internal audit controls, fine-tune alert thresholds, and monitor specific developer productivity initiatives independently of core cybersecurity tooling. For individual developers and repository maintainers, enabled repositories will continue scanning without requiring manual workflow reconfigurations. However, platform engineers and DevOps teams maintaining downstream automation must take action. Any internal dashboards, CI/CD telemetry pipelines, webhook listeners, or usage reporting scripts configured to parse dynamic/github-code-scanning/codeql or filter runs by the github-advanced-security actor must be updated to account for dynamic/github-code-quality/codeql and github-code-quality. Failure to update filtering logic could lead to incomplete usage analytics and inaccurate billing chargeback reports across enterprise organizations.