Prepare CI, Billing and Security Workflows for GitHub’s VS2026 Runners and Code Quality Changes

What Happened

GitHub published a set of coordinated updates that affect CI runners, code‑scanning workflows and audit telemetry:

• The Windows 11 arm64 image with Visual Studio 2026 is now generally available; workflows can opt in immediately with runs-on: windows-11-vs2026-arm. GitHub will migrate the existing windows-11-arm image to Visual Studio 2026 by default between Sept 21–30, 2026, which may break workflows depending on Visual Studio 2022 unless you pin or change runners [1].
• Code scanning gained a new dismissal reason: Mitigated. This marks vulnerabilities that remain in code but are reduced by external compensating controls (WAFs, network policies, etc.), enabling dismissals aligned to risk‑acceptance processes [2].
• GitHub Code Quality now runs under a dedicated Actions workflow path and actor: action path dynamic/github-code-quality/codeql and actor github-code-quality. Workflow history and Actions usage reports distinguish Code Quality runs from other code scanning runs; no repo reconfiguration required but reporting and filters must be updated [3].
• Code Quality enablement changes now emit audit-log events (repo.code_quality_enabled, repo.code_quality_disabled, repo.code_quality_updated) including actor and timestamp, queryable via the audit log API—important because billing counts active committers on enabled repos [4].

Why It Matters to Businesses

• CI reliability risk: The default migration to Visual Studio 2026 can introduce build breaks for teams targeting VS2022, creating outages in release pipelines unless runners are pinned or workflows adjusted [1].
• Billing and usage accuracy: Code Quality now reports separately in Actions usage and introduces audit events that affect repository scope and billing calculations; dashboards, billing reconciliations and automation must account for the new actor and audit events to avoid surprise costs [3][4].
• Traceability for security exceptions: The new Mitigated dismissal reason reduces process friction by keeping exception state in GitHub rather than external trackers, but it requires a disciplined compensating‑control lifecycle to avoid silent risk acceptance [2].
• Operational observability: New audit events enable precise historical tracking of when repos enter Code Quality scope—useful for incident forensics, compliance audits, and billing disputes [4].

Kimbodo Engineering Perspective

From an engineering and ops viewpoint the updates are sensible and useful, but they require short, pragmatic work to avoid operational and financial surprises:

• Pinning vs. drift: Automatic runner upgrades reduce maintenance but increase risk of breaking changes. For production pipelines pin critical environments (or use self‑hosted runners) and allow non‑critical branches to adopt new images sooner.
• Instrumented exception handling: Treat the “Mitigated” dismissal as a first‑class workflow artifact: require a ticket, controls mapping, expiry/renewal, and automated re‑validation. Otherwise, you move technical debt into GitHub without governance.
• Single source of truth for billing and telemetry: Align billing reports, internal dashboards and alerting to the new Code Quality actor and audit events. Relying on historic actor strings or paths will undercount or misattribute usage.
• Automate detection: Add CI smoke tests that detect Visual Studio runtime differences and surface them before release. Use audit-log ingestion to automate billing reconciliation and guardrails for Code Quality enablement.

How We Would Implement It

Immediate steps (first 24–72 hours)

• Pin critical workflows that require VS2022 or opt in to VS2026 explicitly:
  • To opt in: set runs-on: windows-11-vs2026-arm in workflows that need the arm64 VS2026 image [1].
  • To avoid migration: change the runner target for standard runners or the image on larger runners; document these choices in repo CI guidelines [1].
• Update any dashboard, billing script or filter that looks for the old CodeQL path/actor to include dynamic/github-code-quality/codeql and github-code-quality so Code Quality runs aren’t missed in reports [3].
• Add a short policy and template for using the Mitigated dismissal:
  • Require linked ticket/exception, compensating controls, owner and TTL.
  • Automate tagging of the dismissal with metadata (control IDs, review date) when possible [2].

Architecture & automation (weeks)

• Audit-log ingestion pipeline:
  • Subscribe to organization/enterprise audit logs and parse events repo.code_quality_enabled, repo.code_quality_disabled, repo.code_quality_updated to feed CMDB, billing reconciliation and compliance dashboards [4].
  • Store actor and timestamp; correlate with Actions usage and commit activity to calculate billing exposure per repo.
• CI compatibility tests:
  • Add matrix jobs that run builds against both current pinned images and the new VS2026 image to detect regressions early.
  • Fail fast on linker or SDK mismatches and create automated PRs to update toolset pins or migration instructions.
• Security process integration:
  • Extend triage automation to handle “Mitigated” alerts: create a vulnerability exception workflow that attaches compensating‑control evidence and sets renewal reminders.
  • Include mitigated alerts in quarterly risk reviews and threshold gates for release pipelines.

Risks, Costs and Security

• Breaking changes: The VS2026 default migration window can break builds tied to VS2022 toolchains. Mitigation: pin runners, add compatibility matrix jobs, or use self‑hosted runners for stable production builds [1].
• Unexpected billing: Code Quality enablement changes affect billing (active committer counts) and Code Quality runs now appear under a different actor; failing to update billing pipelines can cause misallocated costs or audit exceptions [3][4].
• Misused mitigated dismissals: Without enforced artifacts, mitigated dismissals can become a way to bury unresolved vulnerabilities. Require evidence, owners and TTLs; periodically re‑open mitigated alerts for reassessment [2].
• Audit and access control: Audit-log data is sensitive—restrict access and monitor who enables/disables Code Quality. Ensure audit logs are retained according to compliance requirements and that the ingestion pipeline is tamper‑resistant [4].
• Operational cost: Running additional compatibility matrix jobs and storing audit logs increases compute and storage costs; weigh these against the cost of outages and billing disputes. Prioritize high‑risk repos for intensive checks.

Sources

1. [1] Windows 11 arm64 VS2026 image generally available
2. [2] Code scanning adds a mitigated alert dismissal reason
3. [3] Separate GitHub Actions path for GitHub Code Quality
4. [4] Track GitHub Code Quality enablement changes in the audit log