Question

You are the enterprise security admin for a company with 480 organizations and roughly 12,000 repositories on GitHub Enterprise Cloud. Leadership wants Code Security, Secret Protection, and Supply Chain Security enabled consistently, with the ability to programmatically audit which repositories have each feature turned on and to re-apply the standard baseline whenever drift is detected. Which approach best satisfies the requirement for repeatable, large-scale governance?

Accepted Answer

Create a reusable security configuration and use the REST API for code security configurations to apply it across organizations and query attachment status for drift detection

Answer

Have each organization owner manually toggle the security features in the organization settings UI and record the state in a spreadsheet

Answer

Enable the features only at the enterprise policy level and rely on repository owners to opt in individually per repo

Answer

Write a workflow that pushes a CodeQL YAML file into every repository's default branch and inspect commit history to confirm coverage