Author a custom secret scanning regex pattern at the GitHub organization level, validate it with a dry run, then publish and enable it for push protection

Steps

1. Define the custom pattern (regex, with optional required 'before'/'after' context) in the organization's secret scanning custom patterns settings.
2. Run a dry run against selected repositories (or all repositories in the org) to preview a sample of matches, without generating live alerts, so you can catch obvious false positives before publishing.
3. Refine the regex based on dry-run results, then publish the pattern.
4. After publishing, enable the push protection toggle for that specific pattern; this option only becomes available once the pattern is published and requires push protection to already be enabled at the enterprise or organization level.
5. Confirm push protection for the new pattern only takes effect on repositories that individually have secret scanning push protection turned on, and enable it there if it isn't already.