When should one publish code publicly on GitHub: during or after journal review?
Particular to your situation, I think the exact answer is highly dependent on some missing information:

How do you plan to license the code once released?
Do you have some sort of agreement with the journal that the code is part of the manuscript that they will own the copyright to?

In General: When should one release the code relative to publication? Before! (Allow me to explain)
My knee-jerk response was &quot;why isn't the code already on GitHub (or another hosting site)&quot;?
By publicly posting the code, publicly affiliating yourselves to it, and having a time-stamped &quot;paper&quot; trail of commits. I would expect this provides a good hedge against being &quot;scooped&quot;, similar to, but more robust than, the old signed-and-dated lab books for maintaining development records in the case of IP/patent disputes.
I work, directly or indirectly (and often in a very minor way) on computational chemistry code, but we write the code and store it in a GitHub repo where it's public facing and has open source licenses. The code either gets cited in papers that use it (not necessarily well - see this question) and/or there's an article written up detailing the software that provide details specific to it (and maybe even later publications of new major versions with added features, e.g. RMG and RMG 3 with actively-developed source here)