tl;dr:

  I got an email from github threatening to start billing me, and have
  eliminated most reasons why it would have arrived, and my qgis
  association is next.



For background, I've had a github account for a long time, but never
signed up for a paid plan or given them billing information.   I have
been a listed member of a few organizations, that I "left" a few months
ago as the tone of paid services and AI increased, since they were
defunct anyway.

A few days ago I got email, purporting to be from github, delivered via
sendgrid, and DKIM signed from github.  So I suspect it's really from
them.  Trimming parts that aren't useful enough for anyone to read:

  You're receiving this because your organization is using the GitHub
  Code Quality public preview. As we shared on June 16, Code Quality
  moves to general availability on *July 20, 2026*. This email covers
  the details: what you'll pay, what's included, and how to prepare.

  *Pricing*

  Code Quality is priced as a *base subscription plus metered usage* :

  Component How it's billed What it covers *Per-committer license* $10
  per active committer per month Enterprise access to Code Quality:
  findings, scoring, Rulesets integration, Security Overview, and
  org-level governance *AI-powered usage* Usage-based (AI Credits)
  Copilot code review on Code Quality-enabled repos, AI-assisted
  detection, Copilot Autofix generation *Deterministic analysis* GitHub
  Actions minutes CodeQL-powered maintainability and reliability scans —
  fast, predictable, and token-free

  Active committers are counted on repositories where Code Quality is
  enabled, using the same active-committer methodology as GitHub
  Advanced Security. For more information, you can review our
  documentation here (
  https://docs.github.com/billing/concepts/product-billing/github-code-quality
  ).

  *How to prepare*

  * If you have a GitHub or Microsoft account team, reach out to them with any questions. They have a pricing calculator and can model costs based on your actual usage.
  * Evaluate your repository coverage. Decide which repositories should continue with Code Quality enabled after July 20. Disabling Code Quality on a repository before July 20 means no charges for that repository.

  More details are available in our documentation ( https://docs.github.com/code-security/concepts/about-code-quality ).

  You are receiving this because you’re a part of GitHub Sponsors.

As for sponsors, I am not enrolled, and I have not sponsored anyone.  So
their email is wrong.


I wonder:

  - is qgis using "Code Quality" and somehow because I have a clone,
    have filed issues/etc. I got it?
  - did others get this?
  - any thoughts on whether this is confused, vs underhanded, and is
    anyone worried about surprise bills?