Applying the GitHub-recommended security configuration to your enterprise

Secure your code with the security enablement settings created, managed, and recommended by GitHub.

谁可以使用此功能？

Enterprise owners and members with the admin role

本文内容

The GitHub-recommended security configuration is a set of industry best practices and features that provide a robust, baseline security posture for enterprises. This configuration is created and maintained by subject matter experts at GitHub, with the help of multiple industry leaders and experts. The GitHub-recommended security configuration is designed to successfully reduce the security risks for low- and high-impact repositories. We recommend you apply this configuration to all the repositories in your enterprise.

Warning

GitHub may add new features to the GitHub-recommended security configuration without warning. If you have concerns and prefer to test out features before they are turned on, we suggest you do not use the GitHub-recommended security configuration.

Applying the GitHub-recommended security configuration to repositories in your enterprise

  1. 在 GitHub 的右上角，单击你的个人资料照片。

  2. 根据环境，单击“你的企业”，或单击“你的企业”，然后单击要查看的企业********。

  3. 在页面左侧的企业帐户边栏中，单击 “设置”。

  4. In the left sidebar, click Code security.

  5. In the "GitHub recommended" row of the configurations table for your enterprise, select the Apply to dropdown menu, then click All repositories or All repositories without configurations.

  6. （可选）在“确认”对话框中，可以选择根据其可见性自动将 security configuration 应用到新创建的存储库。 选择 None 下拉菜单，然后单击“公共”或“专用和内部”，或两个选项都单击。

  7. 若要应用 security configuration，请单击“应用”。

security configuration 适用于活动存储库和存档存储库，因为某些安全功能在存档存储库上运行，例如 secret scanning。 此外，如果存储库稍后取消存档，则可以确信它受到所选 security configuration 的保护。

If security configurations fail to apply to some organizations in your enterprise, GitHub will display a banner on the UI to let you know. You can click the links on the banner to get more information about the organizations and repositories involved.

  1. 在 GitHub 的右上角，单击你的个人资料照片。
  2. 根据环境，单击“你的企业”，或单击“你的企业”，然后单击要查看的企业********。
  3. 在页面左侧的企业帐户边栏中，单击 “设置”。
  4. In the left sidebar, click Code security.
  5. In the "Configurations" section, select "GitHub recommended".
  6. In the "Policy" section, next to "Enforce configuration", select Enforce from the dropdown menu.

Note

If a user in your enterprise attempts to change the enablement status of a feature in an enforced configuration using the REST API, the API call will appear to succeed, but no enablement statuses will change.

Some situations can break the enforcement of security configurations for a repository. For example, the enablement of code scanning will not apply to a repository if:

  • GitHub Actions is initially enabled on the repository, but is then disabled in the repository.
  • GitHub Actions required by code scanning configurations are not available in the repository.
  • The definition for which languages should not be analyzed using code scanning default setup is changed.