Question

You are the enterprise administrator for a GitHub Enterprise Cloud instance with 40 organizations and over 5,000 repositories. Leadership wants Code Security (CodeQL default setup) and Secret Protection enabled consistently, with the ability to report on which repositories have applied the settings. You need a repeatable, auditable method that does not require org owners to configure each repository manually. Which approach best meets these requirements?

Accepted Answer

Create an enterprise-level security configuration, apply it to organizations, and use the security configurations API to attach it to repositories and query attachment status at scale.

Answer

Ask each organization owner to enable the features under org-level 'Code security and analysis' defaults so new repositories inherit them going forward.

Answer

Write a script that edits each repository's `.github/workflows/codeql.yml` file directly and enables secret scanning via the repository settings UI.

Answer

Enable the features globally in enterprise policies, which automatically turns them on for every existing and future repository with no further action.