Hey folks, hitting a bit of a wall here and hoping someone else has navigated this. We've been using GitHub Advanced Security (GHAS) for about six months, and our bill was pretty stable and predictable. Last month, we onboarded a new dev team (about 15 more active committers) to our enterprise org.
Now, our bill has nearly tripled! 😳
I was under the impression that GHAS licensing was based on unique committers, which it is, but the jump seems disproportionate. We didn't change our repository count or enable any new features (Code Scanning, Secret Scanning, Dependabot) for these new folks—they're just committing to existing repos that already had GHAS enabled.
My main questions:
* Is this normal linear scaling, or could something be misconfigured?
* Does GHAS count *every* committer on a repo, even if they only make one commit in the billing cycle?
* Could a surge in Dependabot alerts or Code Scanning runs from the increased commit volume cause this, or is it purely a seat/license count?
Here's a snippet of how our GHAS is set up at the org level (via API response):
```yaml
advanced_security:
code_scanning_default_setup: "not-opted-in"
secret_scanning: "enabled"
secret_scanning_push_protection: "disabled"
```
We enable Code Scanning and Advanced Security features at the repository level for specific repos, not org-wide. The new team is committing to repos that already had these features on.
Any insights or similar experiences would be super helpful. Did you see a cost spike with more contributors, and how did you manage it?
-- Weave
Prompt engineering is the new debugging