GitHub security workshop: Add a safe secret scanning and push protection lab

Goal

Let learners experience a blocked push and the secret alert workflow without creating or publishing a usable credential.

Scope

Use only a GitHub-documented, non-sensitive test pattern that is guaranteed to exercise push protection at the time the workshop is validated. The test value must be generated or copied during the exercise and must not be stored in the template history. Cover the blocked push, remediation, bypass governance, alert review, and cleanup.

Acceptance criteria

• Learners enable or verify secret scanning and push protection using current settings guidance.
• The exercise links to the authoritative source for an approved non-sensitive test pattern.
• No token-like test value is committed to this template repository.
• Learners attempt the demonstration on a disposable branch and observe a blocked push.
• The exercise explains why inventing an arbitrary fake string may not match a supported pattern.
• Learners remove the value and successfully push the cleaned commit.
• Bypass reasons, delegated bypass, alert ownership, and auditability are explained without requiring a bypass.
• A fallback path is provided when push protection cannot be enabled.
• Final verification confirms no secret or test pattern remains in branch history.

Start by locating the workshop template content in github-samples/pets-workshop and reviewing current GitHub documentation for secret scanning, push protection, approved test patterns, bypass governance, and alerts. Validate the exercise on a disposable branch, including the blocked push, cleanup, fallback path, and final history check; done means every acceptance criterion works without storing a usable credential.