GitHub security workshop: Teach code scanning alert investigation and triage

Goal

Move beyond enabling CodeQL by teaching learners to understand, prioritize, and disposition a code scanning alert.

Scope

Build an investigation exercise around the deterministic alert from the prior lab. Cover the alert summary, severity, CWE, source-to-sink path, affected branch or pull request, status, and appropriate resolution choices. Do not rely only on screenshots or exact control positions.

Acceptance criteria

• Learners locate the alert from both the pull request/check context and repository Security experience.
• The exercise explains severity, precision, CWE, query help, data-flow steps, and affected branches.
• Learners distinguish a true positive, false positive, test-only finding, and accepted risk.
• Dismissal reasons and audit implications are explained without encouraging dismissal of the lab finding.
• Learners record a short triage decision and remediation plan.
• Plan- or role-dependent UI differences have a documented fallback.
• Completion is based on observable alert details rather than matching a screenshot.

Beginne damit, den deterministischen Alert des vorherigen Labs und die bestehende Struktur der Workshop-Übung zu lokalisieren. Verwende den Pull-Request-/Check-Kontext und die Security-Erfahrung des Repositorys, um den Untersuchungsablauf zu überprüfen; stelle dann sicher, dass die Übung die aufgeführten Alert-Details, Triage-Ergebnisse, Auswirkungen der Zurückweisung, UI-Fallbacks und eine beobachtbare Triage-Entscheidung abdeckt, ohne auf Screenshots angewiesen zu sein.