What's changed: New GH-500 Chapter 6 (large-scale rollout & defaults = enterprise→org→repo hierarchy and inheritance, GHEC vs GHES differences, enabling each feature, default security configurations [recommended/custom]; governance & automation = policy/ruleset enforcement, enforcement boundaries/bypass/exceptions [approval-gated + recorded], roles [admin/security manager/developer] and alert permissions, default/approved custom CodeQL workflows, APIs/automation to govern hundreds–thousands of repos)
6.1Rolling Out at Scale and Default Configurations
Understand enabling GitHub Security suites at enterprise/organization/repository levels, feature differences between GitHub Enterprise Cloud and Server, enabling Code Security/Secret Protection/Supply Chain, and default configurations and inheritance behavior.
Enabling features one repo at a time can’t keep up in a large org. Admins roll out features in bulk across the enterprise, organization, and repository hierarchy and keep a consistent state via default configurations and inheritance. GH-500’s final domain tests this large-scale enablement, defaults, and inheritance.
6.1.1Enabling at enterprise, org, and repo levels
GHAS features (Code Security, Secret Protection, Supply Chain) are managed in a hierarchy: set policy at the enterprise level flowing to member orgs, bulk-enable at the organization level, and fine-tune at the repository level. Policy set higher cascades (is inherited) downward, and lower levels operate within the upper constraints. Means exist to enable at once across many new/existing repos, quickly widening org-wide coverage.
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.