Enable GitHub secret scanning push protection organization-wide using the code security configurations API

Steps

1. Create or update an organization code security configuration via the code security configurations API, setting secret_scanning and secret_scanning_push_protection to enabled.
2. Attach the configuration as the organization default, or explicitly assign it to target repositories using the configuration attach endpoint.
3. For enterprise-wide enforcement, use the equivalent enterprise code security and analysis endpoints so new organizations inherit push protection by default.
4. Query the repository's security_and_analysis object (or the organization configuration detail endpoint) to confirm push protection is actually enabled per repository, since attachment can be asynchronous.
5. List resulting secret scanning alerts, including any org-defined custom patterns, via the repository secret scanning alerts endpoint, since results from custom patterns surface through that API even though the patterns themselves are authored elsewhere.