GitHub security workshop: Teach code scanning alert investigation and triage

Goal

Move beyond enabling CodeQL by teaching learners to understand, prioritize, and disposition a code scanning alert.

Scope

Build an investigation exercise around the deterministic alert from the prior lab. Cover the alert summary, severity, CWE, source-to-sink path, affected branch or pull request, status, and appropriate resolution choices. Do not rely only on screenshots or exact control positions.

Acceptance criteria

• Learners locate the alert from both the pull request/check context and repository Security experience.
• The exercise explains severity, precision, CWE, query help, data-flow steps, and affected branches.
• Learners distinguish a true positive, false positive, test-only finding, and accepted risk.
• Dismissal reasons and audit implications are explained without encouraging dismissal of the lab finding.
• Learners record a short triage decision and remediation plan.
• Plan- or role-dependent UI differences have a documented fallback.
• Completion is based on observable alert details rather than matching a screenshot.

Start by locating the prior lab's deterministic alert and the existing workshop exercise structure. Use the pull request/check context and repository Security experience to verify the investigation flow, then ensure the exercise covers the listed alert details, triage outcomes, dismissal implications, UI fallbacks, and an observable triage decision without relying on screenshots.