GitHub security workshop: Teach code scanning alert investigation and triage

Goal

Move beyond enabling CodeQL by teaching learners to understand, prioritize, and disposition a code scanning alert.

Scope

Build an investigation exercise around the deterministic alert from the prior lab. Cover the alert summary, severity, CWE, source-to-sink path, affected branch or pull request, status, and appropriate resolution choices. Do not rely only on screenshots or exact control positions.

Acceptance criteria

• Learners locate the alert from both the pull request/check context and repository Security experience.
• The exercise explains severity, precision, CWE, query help, data-flow steps, and affected branches.
• Learners distinguish a true positive, false positive, test-only finding, and accepted risk.
• Dismissal reasons and audit implications are explained without encouraging dismissal of the lab finding.
• Learners record a short triage decision and remediation plan.
• Plan- or role-dependent UI differences have a documented fallback.
• Completion is based on observable alert details rather than matching a screenshot.

Inizia individuando l’alert deterministico del lab precedente e la struttura esistente dell’esercizio del workshop. Usa il contesto della pull request/check e l’esperienza Security del repository per verificare il flusso di analisi; assicurati quindi che l’esercizio copra i dettagli dell’alert elencati, gli esiti del triage, le implicazioni del rifiuto, i fallback della UI e una decisione di triage osservabile senza dipendere da screenshot.