Audit: GitHub security settings and CodeQL¶

What we check¶

All active repositories should have these settings enabled in Settings > Code security and analysis:

Setting	Recommended
Dependabot security updates	Enabled
Secret scanning	Enabled
Secret scanning push protection	Enabled

Additionally recommended:

Setting	Recommended
Allow auto-merge	Enabled

Delete branch on merge is required rather than recommended, and is checked by its own audit: see delete-branch-on-merge.md.

All public projects should have a .github/workflows/codeql-analysis.yml for advanced security scanning.

Private repos are excluded: CodeQL requires a paid GHAS license for private repos. Without GHAS, the workflow will fail.

The CodeQL workflow must have job-level permissions:

jobs:
  analyze:
    permissions:
      actions: read
      contents: read
      security-events: write

The actions: read permission is required for workflow run telemetry.

CodeQL template: templates/codeql/ See: templates/codeql/README.md

Security settings: UI-only configuration, no template needed.

Per-project compliance for this criterion is regenerated every morning by the consistency audit: see the compliance page.