To achieve this, you should configure code security and analysis policies at the GitHub Enterprise account level while assigning members the Organization Owner role within their respective organizations.
Enforcing these settings at the Enterprise level overrides lower-level changes. This allows you to globally control GitHub Advanced Security (GHAS) policies while delegating membership and daily operations to individual organization administrators.
Reference:
https://docs.github.com/en/[email protected]/organizations/collaborating-with-groups-in-organizations/about-organizations

For compiled languages, CodeQL performs extraction bymonitoring the normal build process.
This means it watches your usual build commands (like make, javac, or dotnet build) and extracts the relevant data from the actual build steps being executed. CodeQL uses this information to construct a semantic database of the application.
This approach ensures that CodeQL captures a precise, real-world representation of the code and its behavior as it is compiled, including platform-specific configurations or conditional logic used during build.

If auto build fails (which attempts to automatically detect how to build your project), you shoulddisable itin your workflow andreplace it with explicit build commands, using steps like run:
make or run: ./gradlew build.
This ensures CodeQL can still extract and analyze the code correctly.

GitHub automatically closes a code scanning alert when the vulnerable code is fixed in the same branch where the alert was generated, usually via a commit inside a pull request. Simply clicking or triaging an alert does not resolve it. The alert is re-evaluated after each push to the branch, and if the issue no longer exists, it is marked as resolved.