GitHub security workshop: Add dependency risk and remediation workflow

Goal

Teach learners to identify, prioritize, and remediate vulnerable dependencies using the dependency graph, Dependabot alerts, security updates, and pull-request checks.

Scope

Use a deterministic and isolated dependency fixture or a maintainer-selected advisory rather than permanently weakening the application dependencies. Cover direct versus transitive dependencies, advisory and severity information, compatibility review, update PRs, and post-merge verification.

Acceptance criteria

• Learners enable or verify the dependency graph, Dependabot alerts, and security updates.
• The lab produces a predictable dependency alert without leaving an intentionally vulnerable package on the default branch.
• Learners identify whether the package is direct or transitive and review the advisory, affected range, patched version, and severity.
• Learners review or create a remediation pull request and run the project tests against the update.
• The alert is verified as resolved after the safe version is merged.
• The exercise discusses grouped updates, compatibility risk, dismissals, and remediation ownership.
• Timing and no-fix-available scenarios have documented fallback data.
• The content coordinates with #237 rather than duplicating its repository-wide Dependabot configuration work.

Inizia esaminando la struttura esistente del workshop e l’issue #237 per comprendere il lavoro di configurazione di Dependabot a livello dell’intero repository ed evitare duplicazioni. Definisci come il lab utilizzerà un fixture di dipendenze isolato o un advisory selezionato da un maintainer, inclusi dati di fallback per i casi di temporizzazione e gli scenari senza fix. Il lavoro è completato quando l’esercizio documentato copre la scoperta degli alert, la revisione del rischio, il test della remediation, il merge sicuro, la verifica della risoluzione e gli argomenti di workflow elencati.