A) By using the GitHub Advanced Security API endpoints

Before enabling GHAS for GitHub Enterprise Server, first you need to enable the Advanced Security for the GH Server instance (and your license must support Advanced security). You can do that either in the interface or the CLI, but it's important to notice you have to enable each feature of Advanced Security (and you'll be billed for them, so take care) . After you do that, you can reload your server instance, navigate to the Settings tab -> Code security and analysis of your organizations and configure how you want to enable the GHAS for the organizations and repositories.

To enable GHAS features in the organization level, you need to go to your organization's Settings tab -> Code security and analysis. You can choose to enable all the features, or only the features that you want, like dependabot. You can also check to automatically enable the features for new repositories.

The security policies for a repository are informations displayed in the security tab of the repo (for those who don't have access to alerts) that tells how to report vulnerabilities, what are the supported versions of the application, and other useful stuff. To configure them, you just need to create the security.md markdown file in the .github/ folder, docs/ folder or in the root of the repository.

The security policy in the organization level is a little more powerful. In the enterprise settings, you can create policies to allow all your organizations or only selected ones to enable GHAS features in their repositories (that's smart, because it can become very expensive if uncontrolled).

The permissions in a security workflow are, by default, evaluated using a GITHUB_TOKEN. It will grant read and/or write permissions depending on the scope (actions, issues, PRs, etc). You can also define your own custom permissions overriding the GITHUB_TOKEN using the permissions key in workflow yaml files. It can be applied to the entire workflow or only for specific jobs.

GitHub also has different API endpoints for each Advanced Security feature, that can be useful in the development lifecycle. Each API has different purposes, but in general, they allow users to enable/disable the security feature and retrieve security alerts. The code scanning API also allows you to update SARIF files from external scanning tools. For more information, you can check the documentation in:

1. Code scanning
2. Secret scanning
3. Repos
4. GraphQL

With GHAS, I understand the security workflow affects the entire development lifecycle, so this list should include from developers to product owners. The developers are responsible for fixing security vulnerabilities, tech leaders are responsible for managing the technology stack and helping the developers in the solutions, the security managers who create the security policies, the devops engineers who create the pipelines and orchestrate the security workflows and the product owners who manage the timelines and decide what is the standard level of security the product needs.

Go to Settings tab > Code security and analysis, scroll down to code scanning section. In the set up drop-down you select "default". You'll be prompted some basic configurations and GitHub will do the rest for you (creating a hidden workflow file that you don't have access to). After you finish the setup, you can enable code scanning and it will run the first scan for the repository.

The initial steps are similar to the default workflow, but in the code scanning section you'll select "advanced". With this setup you will have a codeql.yml workflow file to work on. There you can configure custom build commands for your application, custom codeQL queries, file exclusions and other useful configuration. You can do it directly in the workflow file or you can reference a configuration file, like codeql-config.yml.

1. A
2. C
3. B
4. B
5. D
6. D
7. B