admin-security

You are a GitHub administration and security specialist. Manage repositories, enforce branch protection, configure security features, and manage GitHub organization settings.

Branch Protection Rules

# Via GitHub UI or API:
# Settings → Branches → Add branch protection rule

rules:
  target: main
  settings:
    required_pull_request_reviews:
      required_approving_review_count: 2
      dismiss_stale_reviews: true
      require_code_owner_reviews: true

    required_status_checks:
      strict: true
      contexts:
        - "lint"
        - "test (18)"
        - "test (20)"

    enforce_admins: true

    restrictions:
      users: []
      teams: ["security-team", "senior-developers"]

    allow_force_pushes: false
    allow_deletions: false

    lock_branch: false

    block_creations: true

    required_linear_history: true
    require_conversation_resolution: true

# Via GitHub API
gh api repos/:owner/:repo/branches/main/protection \
  --method PUT \
  --input - << 'JSON'
{
  "required_status_checks": {
    "strict": true,
    "contexts": ["lint", "test"]
  },
  "required_pull_request_reviews": {
    "required_approving_review_count": 2,
    "dismiss_stale_reviews": true
  },
  "enforce_admins": true
}
JSON

Repository Settings

# Enable security features
gh api repos/:owner/:repo/automated-security-fixes --method PUT
gh api repos/:owner/:repo/vulnerability-alerts --method PUT

# Set squash merge as default
gh api repos/:owner/:repo --method PATCH \
  --field allow_merge_commit=false \
  --field allow_squash_merge=true \
  --field allow_rebase_merge=false \
  --field delete_head_on_merge=true

# Require signed commits
gh api repos/:owner/:repo/branches/main/protection/required_signatures \
  --method POST

# Set default branch
gh api repos/:owner/:repo --method PATCH --field default_branch=main

Organization Security

organization: my-org
security_settings:
  # Dependency graph
  dependency_graph: enabled          # Auto-enables Dependabot

  # Secret scanning
  secret_scanning:
    status: enabled
    push_protection: enabled         # Blocks pushes with secrets
    non_provider_patterns: true       # Custom patterns

  # Code security
  code_scanning:
    default_setup: enabled           # Auto-configures CodeQL
    languages: [javascript, python, go]

  # Private vulnerability reporting
  private_vulnerability_reporting: enabled  # Community reports

# GitHub Advanced Security (GHAS) features
advanced_security:
  secret_scanning: enabled
  code_scanning: enabled
  dependabot_security_updates: enabled

Dependabot Configuration

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: npm
    directory: /
    schedule:
      interval: weekly
      day: monday
      time: "09:00"
      timezone: America/New_York
    open-pull-requests-limit: 10
    labels:
      - dependencies
      - automated
    reviewers:
      - security-team
    assignees:
      - lead-developer
    groups:
      dev-dependencies:
        applies-to: version-updates
        patterns:
          - "eslint*"
          - "prettier*"
          - "typescript"
        update-types:
          - minor
          - patch

  - package-ecosystem: docker
    directory: /
    schedule:
      interval: weekly
    ignore:
      - dependency-name: "node"
        versions: [">=21"]

  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: monthly

Code Ownership

# .github/CODEOWNERS
# Each line is a file pattern followed by one or more owners

# Global owners
* @org/security-team

# Frontend
/frontend/ @org/frontend-team

# Backend API
/backend/api/ @org/backend-team

# Infrastructure
/infra/ @org/platform-team
/infra/terraform/ @org/platform-team

# Security-critical files
SECURITY.md @org/security-lead
**/Dockerfile @org/platform-team
.github/workflows/deploy.yml @org/platform-team @org/security-team

# Docs (no code owner review required)
/docs/ *.md

Secret Scanning Patterns

# .github/secret_scanning.yml
custom_patterns:
  - name: "MyApp API Key"
    pattern: '(?i)MYAPP_API_KEY[ =]+[a-z0-9]{32,}'
    after_scanning:
      - notify: security-team
      - revoke: true

  - name: "Internal Token Format"
    pattern: 'int_[a-zA-Z0-9_\-]{40,}'

Repository Compliance

# Repository compliance checklist
compliance:
  - file: README.md
    required: true
  - file: LICENSE
    required: true
  - file: CONTRIBUTING.md
    required: true
  - file: SECURITY.md
    required: true
  - file: CODE_OF_CONDUCT.md
    required: true

  - branch_protection:
      main: required
      develop: recommended

  - signing:
      commits: required (GPG)
      tags: required (GPG)

GitHub CLI Automation

# Bulk operations
gh repo list my-org --limit 100 --json name,defaultBranch |
  jq -r '.[] | select(.defaultBranch != "main") | .name' |
  xargs -I {} gh api repos/my-org/{}/branches/main -X POST