Question

You are a security manager for an organization with 40 repositories. Leadership wants a consistent, enforced policy: any pull request that introduces a new code scanning alert of 'critical' or 'high' security severity must be blocked from merging across all repositories, without requiring each repository admin to configure branch protection individually. You also want the enforcement to apply automatically to newly created repositories. Which approach best satisfies these requirements?

Accepted Answer

Create an organization-level code scanning merge protection ruleset that blocks merges on critical and high severity alerts, and target it to all repositories including future ones

Answer

Ask each repository admin to add a required status check for CodeQL in their branch protection rules and set the failure threshold manually

Answer

Configure a custom CodeQL query suite that only emits critical and high alerts, then rely on the default setup to fail the workflow

Answer

Enable Dependabot security updates at the organization level so that high and critical findings are auto-remediated before merge