Automating code scanning rollout with GitHub’s Advanced Security Enforcer
Rolling out GitHub Advanced Security features like code scanning and secret scanning across an organization typically requires manual setup in every repository. The Advanced Security Enforcer, a GitHub Action built by GitHub Services Engineers, automates that process. Originally created to help a large government agency consistently enable code scanning as it scaled, the action is now open sourced and available on the GitHub Marketplace.
Organizations running the action nightly can ensure that newly created repositories are configured for code scanning, even when teams don’t start from a template. Code scanning currently supports C/C++, Java, C#, Python, Go, JavaScript, and TypeScript, with additional languages planned.
How the action works
Once the action is configured in an organization, it monitors for new repository creation. When a new repository appears, the action opens a pull request that adds a code scanning configuration file, bringing the repository into compliance without manual intervention.
To get started, create a repository in the target organization and copy the example workflow file from the GitHub Actions page. The next step is configuring three repository secrets:
GH_ACTOR: a valid org email address that provides a higher API rate limit.GH_TOKEN: a personal access token with repo read permission across all org repositories, preferably from a service account.ORGANIZATION: the organization name as it appears on GitHub.
With those set, the action runs daily, and you can review its runs to verify that new repositories are being picked up and configured.
Contributing back
The Advanced Security Enforcer is open for community contributions. If you’re using the action or want to improve it, see the project’s contributing guide. More details are available in the Advanced Security Enforcer repository.
