Skip to main content
ドキュメントには頻繁に更新が加えられ、その都度公開されています。本ページの翻訳はまだ未完成な部分があることをご了承ください。最新の情報については、英語のドキュメンテーションをご参照ください。本ページの翻訳に問題がある場合はこちらまでご連絡ください。

Managing security and analysis settings for your organization

You can control features that secure and analyze the code in your organization's projects on GitHub.

Organization owners can manage security and analysis settings for repositories in the organization.

About management of security and analysis settings

GitHub can help secure the repositories in your organization. You can manage the security and analysis features for all existing or new repositories that members create in your organization. Organizations that use GitHub Enterprise Cloud with a license for GitHub Advanced Security can also manage access to these features. For more information, see the GitHub Enterprise Cloud documentation.

ノート: パブリックリポジトリにデフォルトで有効化されているセキュリティ及び分析の機能の中には、無効化できないものがあります。

セキュリティと分析の機能を有効化すると、 GitHubはリポジトリ上で読み取りのみの分析を行います。 詳しい情報については、「GitHub によるデータ使用について」を参照してください。

Displaying the security and analysis settings

  1. In the top right corner of GitHub.com, click your profile photo, then click Your organizations. プロフィールメニューのあなたのOrganization

  2. Organizationの隣のSettings(設定)をクリックしてください。 設定ボタン

  3. In the "Security" section of the sidebar, click Code security and analysis.

The page that's displayed allows you to enable or disable all security and analysis features for the repositories in your organization.

Enabling or disabling a feature for all existing repositories

You can enable or disable features for all repositories. The impact of your changes on repositories in your organization is determined by their visibility:

  • Dependency graph - Your changes affect only private repositories because the feature is always enabled for public repositories.
  • Dependabotアラート - Your changes affect all repositories.
  • Dependabotセキュリティアップデート - Your changes affect all repositories.
  1. Go to the security and analysis settings for your organization. For more information, see "Displaying the security and analysis settings."

  2. Under "Code security and analysis", to the right of the feature, click Disable all or Enable all.

    "Enable all" or "Disable all" button for "Configure security and analysis" features

  3. Optionally, enable the feature by default for new repositories in your organization.

    "Enable by default" option for new repositories

  4. Click Disable FEATURE or Enable FEATURE to disable or enable the feature for all the repositories in your organization.

    Button to disable or enable feature

既存のリポジトリで1つ以上のセキュリティ及び分析機能を有効化すると、数分のうちにGitHub上に結果が表示されます。

  • 既存のすべてのリポジトリは、選択された設定を持ちます。
  • 新しいリポジトリに対するチェックボックスを有効化していれば、新しいリポジトリは選択された設定に従うようになります。
  • 関連するサービスに適用するマニフェストファイルをスキャンするために権限を使用します。
  • If enabled, you'll see dependency information in the dependency graph.
  • If enabled, GitHub will generate Dependabotアラート for vulnerable dependencies or malware.
  • If enabled, Dependabot security updates will create pull requests to upgrade vulnerable dependencies when Dependabotアラート are triggered.

Enabling or disabling a feature automatically when new repositories are added

  1. Go to the security and analysis settings for your organization. For more information, see "Displaying the security and analysis settings."

  2. Under "Code security and analysis", to the right of the feature, enable or disable the feature by default for new repositories, or all new private repositories, in your organization.

    Screenshot of a checkbox for enabling a feature for new repositories

Allowing Dependabot to access private dependencies

Dependabot can check for outdated dependency references in a project and automatically generate a pull request to update them. To do this, Dependabot must have access to all of the targeted dependency files. Typically, version updates will fail if one or more dependencies are inaccessible. For more information, see "About Dependabot version updates."

By default, Dependabot can't update dependencies that are located in private repositories or private package registries. However, if a dependency is in a private GitHub repository within the same organization as the project that uses that dependency, you can allow Dependabot to update the version successfully by giving it access to the host repository.

If your code depends on packages in a private registry, you can allow Dependabot to update the versions of these dependencies by configuring this at the repository level. You do this by adding authentication details to the dependabot.yml file for the repository. For more information, see "Configuration options for the dependabot.yml file."

To allow Dependabot to access a private GitHub repository:

  1. Go to the security and analysis settings for your organization. For more information, see "Displaying the security and analysis settings."

  2. Under "Dependabot private repository access", click Add private repositories or Add internal and private repositories. Add repositories button

  3. Start typing the name of the repository you want to allow. Repository search field with filtered dropdown

  4. Click the repository you want to allow.

  5. Optionally, to remove a repository from the list, to the right of the repository, click . "X" button to remove a repository

Further reading