Question

A platform security lead wants to enforce a single organization-wide policy that (1) blocks pull requests introducing code scanning alerts of 'high' security severity or above, and (2) prevents merges when Dependabot detects a 'critical' vulnerability in a new dependency. They want this enforced consistently across dozens of repositories without configuring each repo individually. Which GitHub capability best achieves this cross-suite enforcement from a single point of control?

Accepted Answer

Define organization rulesets (including code scanning merge protection rules) combined with an enterprise/org security configuration and the dependency review action gated on severity, applied across the targeted repositories

Answer

Configure branch protection rules manually in each repository, adding required status checks for CodeQL and dependency review

Answer

Create an organization-level security configuration and apply it to repositories, but rely on each developer to self-enforce severity thresholds

Answer

Add a single CodeQL workflow with a security-severity filter and rely on it to also block vulnerable dependency merges