GitHub audit logs now record Code Quality finding dismissals and reopenings
GitHub announced on October 13 that manual dismissals and reopenings of Code Quality findings can be reviewed in organization and enterprise audit logs. Findings may appear in a repository's default-branch backlog or in pull requests.
Two new events record the actions. The repo.code_quality_findings_dismissed event records dismissal of one or more backlog findings; repo.code_quality_findings_reopened records reopening of one or more backlog findings.
Each event identifies who made the request and when it happened. It also includes the repository, the rule, and the identifiers and count of affected findings. That gives reviewers a record of the action rather than only the finding's current state.
For repositories with Code Quality enabled, GitHub says no additional setup is needed. A person with access to the organization or enterprise audit log can filter by the two action names to review activity.
On GitHub Enterprise Cloud, the events can also be retrieved through the audit log API. The change is generally available on GitHub Team and GitHub Enterprise Cloud, including enterprises with data residency. It is not available on GitHub Enterprise Server.
For teams using automated code-review workflows, these records can help trace manual decisions about Code Quality findings. A dismissal record is not proof that a finding was fixed, and the announcement does not describe a new vulnerability scanner or automatic remediation. Reviewers still need to assess the finding and the reason for the action.