GitHub security workshop: Add a custom CodeQL query exercise

Goal

Teach how CodeQL can enforce an organization-specific security rule that is not represented by the default query suite.

Scope

Choose one simple, app-relevant Python pattern and provide a small starter query that learners can understand and extend. Document the tested execution path using supported CodeQL tooling, then show how a query pack or configuration is incorporated into repository analysis.

Acceptance criteria

• The target pattern is security-relevant, specific to the pets app, and has a deterministic positive and negative example.
• The exercise explains the query metadata, imports, predicates, result selection, and help text at an introductory level.
• A pinned/tested CodeQL CLI or supported hosted workflow is documented.
• Learners run the query and see exactly the expected result set.
• The custom query is packaged and referenced using a currently supported CodeQL configuration.
• A subsequent repository analysis reports the custom result with recognizable metadata.
• Maintainer validation detects query compilation failures and result drift.
• The exercise documents feature or plan constraints and an observation-only fallback.

Beginnen Sie mit dem Python-Code der pets app und dem in der Aufgabe beschriebenen unterstützten CodeQL CLI- oder hosted-workflow-Pfad. Definieren Sie ein deterministisches positives und negatives Beispiel und dokumentieren Sie anschließend die Starterabfrage, das Packaging, die Konfiguration, die erwarteten Ergebnisse, die Validierung, die Einschränkungen und den Fallback, damit die Übung jedes Akzeptanzkriterium erfüllt.