– [Configure GitHub Advanced Security Tools in GitHub Enterprise] What role is required to change a repository's code scanning severity threshold…

Configuring the rules for code scanning, including the severity thresholds that cause a pull request check to fail, is a critical repository security setting. According to official GitHub documentation, only users with administrative permissions for a repository have the authority to modify these settings. This restriction ensures that the repository's security posture is managed by authorized personnel and prevents contributors or maintainers from weakening security enforcement policies. The setting is located under the repository's "Settings" > "Code security and analysis" section, which is accessible only to administrators.

A. Maintain: The maintain role can manage many repository settings but does not have permission to alter fundamental security configurations like code scanning failure conditions.

B. Write: The write role allows users to contribute code and manage pull requests but does not grant access to configure repository-level security settings.

C. Triage: The triage role is limited to managing issues and pull requests and can dismiss alerts, but it cannot configure the rules that generate those alerts.

1. GitHub Docs, "Configuring pull request checks." This document explicitly states the permission required for this task.

Reference: In the section "Configuring pull request checks," the documentation states, "People with admin permissions for a repository can configure code scanning to check the code in a pull request."

Source: GitHub, Inc. (2024). Configuring pull request checks. GitHub Docs. Retrieved from https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code/configuring-pull-request-checks

2. GitHub Docs, "Repository roles for an organization." This page details the capabilities of each role, confirming that managing security settings is an admin-level privilege.

Reference: The permissions table shows that only the "Admin" role has the ability to "Manage repository settings," which includes security features like code scanning rules.

Source: GitHub, Inc. (2024). Repository roles for an organization. GitHub Docs. Retrieved from https://docs.github.com/en/organizations/managing-access-to-your-organizations-repositories/managing-repository-roles/repository-roles-for-an-organization