GitHub audit logs now record Code Quality dismissals and reopenings

GitHub [announced on October 13](https://github.blog/changelog/2026‑10‑13‑audit‑github‑code‑quality‑finding‑dismissals‑and‑reopenings/) that organization and enterprise audit logs now record manual Code Quality finding dismissals and reopenings. The events cover findings in a repository's default‑branch backlog or in pull requests. `repo.code_quality_findings_dismissed` records one or more backlog findings being dismissed. `repo.code_quality_findings_reopened` records one or more being reopened. GitHub says each record includes the actor, time, repository, rule, affected finding identifiers and count. For teams that already use Code Quality, no additional feature setup is required. Audit‑log access and retention still follow the organization's plan and permissions.

The new events are generally available on GitHub Team and GitHub Enterprise Cloud, including enterprises with data residency. GitHub explicitly says the change is not available on GitHub Enterprise Server. Users with access to an organization or enterprise audit log can filter the web interface by the two action names. Enterprise Cloud customers can also retrieve them through the audit log API, which supports downstream monitoring and retention. A mixed GitHub.com and Enterprise Server estate should keep the coverage gap explicit. An empty query on an unsupported server is not evidence that no findings were dismissed.

The events provide an attribution trail for a state change. They do not independently establish that a dismissal was justified, that the underlying finding was a false positive or that the affected code was safe. A review workflow should join the event to the finding, pull request or backlog item and to the team's approval evidence. Compare the recorded rule and finding identifiers with the code revision that was reviewed. Preserve the actor and timestamp, then assess the reason under the organization's policy. Reopening an item is also a state change, not proof that the original dismissal was malicious or negligent. Treat it as a trigger for review rather than a conclusion.

GitHub's [organization audit‑log guide](https://docs.github.com/en/enterprise‑cloud@latest/organizations/keeping‑your‑organization‑secure/managing‑security‑settings‑for‑your‑organization/reviewing‑the‑audit‑log‑for‑your‑organization) says organization owners can review activity through the web interface, export data or use the REST API on Enterprise Cloud. The audit log retains organization events for 180 days, while the interface defaults to a shorter recent window unless a date range is supplied. Build queries with the exact `action` value and add repository, actor and date filters as needed. If a control depends on long‑term evidence, stream or export the records under an approved retention policy rather than assuming the GitHub interface is a permanent archive. API access and export success confirm retrieval, not review. Track which events were assessed and how exceptions were resolved.

Start by querying both action names across a bounded date range. Verify that a known test dismissal produces the expected actor, repository, rule, identifiers and count, then reopen it and confirm the companion event. Route unexpected changes to the repository or application‑security owner. Check whether the action matched an approved exception, whether the finding still applies to the current revision and whether similar findings were changed in bulk. Keep unknown rationale as unknown until supporting evidence is found. The new events close an attribution gap, while policy quality and investigation remain operator responsibilities. Follow [GitHub's OpenTools organization page](https://opentools.ai/organizations/github) for further governance changes. *Image: Real screenshot of GitHub's official October 13 Code Quality audit‑log release page. OpenTools captured the source page without generative alteration or artificial upscaling.*