First, configure Advanced Security and enable code scanning (note: this is a feature available only for public repositories).
Optional
In the repository’s Settings → Rules, enable Require code scanning results for a specific branch; this ensures that code scanning must be completed before updates can be pushed to that branch.