GitHub security workshop: Add Copilot-assisted remediation and verification

Goal

Teach a complete remediation loop: understand a CodeQL finding, use Copilot as an optional assistant, review the proposed fix, test it, and verify the security alert is resolved.

Scope

Use the alert introduced by the CodeQL lab. Prompts should ask Copilot to explain the weakness and propose a minimal secure change, but learners must validate the output rather than accept it automatically. Include an equivalent manual remediation path for learners without Copilot.

Acceptance criteria

• The exercise provides model-agnostic example prompts for explanation, remediation, and test generation.
• A manual secure implementation is available as a fallback.
• Learners review the change against the CodeQL data flow and secure coding guidance.
• Focused behavior tests cover the vulnerable path and pass after remediation.
• Learners commit the fix to the lab branch and trigger code scanning again.
• The pull request check passes and the original alert is shown as fixed or absent from the updated analysis.
• The exercise states that Copilot output is untrusted until reviewed and tested.
• No specific optional model or transient UI layout is required.

Inizia dall’alert introdotto dal CodeQL lab esistente e ricostruisci il percorso vulnerabile e i relativi test comportamentali mirati. Aggiungi quindi le indicazioni di remediation assistite da Copilot e quelle manuali, esegui il commit della correzione nel branch del lab, riesegui code scanning e conferma che il controllo della pull request abbia esito positivo e che l’alert originale sia stato risolto o non sia presente.