Question

As an enterprise owner on GitHub Enterprise Cloud, you have applied a security configuration to all organizations that enables secret scanning and push protection. Several organization owners have been disabling push protection in their repositories to avoid workflow friction. You need a way to guarantee that these two features remain enabled and that organization owners cannot turn them off, while still allowing them to enable additional features on their own. What should you do?

Accepted Answer

Apply the enterprise-level security configuration with its enforcement status set to 'Enforced', so organizations and repositories cannot modify the settings defined in that configuration.

Answer

Create an organization-level ruleset that requires push protection and rely on each organization owner to keep it in place.

Answer

Assign the security manager role to a trusted person in every organization and instruct them to re-enable push protection whenever it is turned off.

Answer

Detach the repositories from the security configuration so their settings are locked to the last applied values.