Question

You are the security manager for an organization on GitHub Enterprise Cloud. Leadership wants to guarantee that no pull request targeting the default branch of any repository in the org can be merged unless a CodeQL analysis has completed successfully. You want a single, org-wide control that enforces this consistently across all current and future repositories without editing each repository's branch protection settings individually. Which approach best meets this requirement?

Accepted Answer

Create an organization-level ruleset targeting the default branch with a required workflows / required status check rule for the CodeQL analysis, applied to all repositories

Answer

Enable CodeQL default setup on each repository and rely on it to automatically block merges when analysis has not completed

Answer

Add a branch protection rule to each repository's default branch requiring the CodeQL status check, then document the process for new repositories

Answer

Configure a repository-level ruleset in a template repository so that forked and generated repositories inherit the merge requirement automatically