Question

A platform security team wants to enforce a consistent remediation SLA across 40 repositories: any open code scanning alert with a security severity of 'critical' or 'high' must block deployment to production, while medium and low alerts should only generate warnings. They also need the enforcement to survive when individual repository admins try to loosen their local branch protection settings. Which approach best meets these requirements at scale?

Accepted Answer

Create an organization-level code scanning ruleset that requires resolution of alerts at the critical and high security-severity levels and apply it to all 40 repositories, since org rulesets take precedence over repository-level configuration.

Answer

Ask each repository admin to add a branch protection rule requiring the CodeQL status check to pass, and document the SLA in a shared wiki for accountability.

Answer

Configure a Dependabot auto-triage rule set to snooze medium and low alerts and open pull requests for critical and high alerts across the organization.

Answer

Enable push protection at the organization level so that any commit introducing a critical or high alert is blocked before it reaches the default branch.