GitHub security workshop: Enforce security merge gates with rulesets

Goal

Teach learners to turn security scanning from advisory feedback into an enforceable pull-request policy.

Scope

Create a repository ruleset for the default branch that requires the tested security checks and prevents a vulnerable pull request from merging. Explain check naming, merge-base behavior, bypass governance, and plan-dependent alternatives.

Acceptance criteria

• Learners create a ruleset targeting the default branch without locking themselves out of the workshop.
• The ruleset requires the CodeQL/security check produced by earlier exercises.
• A pull request containing the training finding is visibly blocked from merging.
• After remediation and a fresh scan, the same pull request becomes eligible under the security gate.
• The exercise explains required status checks, required code scanning results where available, bypass actors, and evaluate/disabled modes.
• A repository-level fallback is documented for plans that lack an organization-level control.
• Cleanup instructions remove or disable the lab ruleset after verification.
• The exercise does not duplicate the generic CI ruleset lesson in the Actions workshop; it focuses specifically on security policy.

Start by reviewing the CodeQL/security-check exercise referenced in the issue and the generic CI ruleset lesson in the Actions workshop. Build the security-focused workshop flow around the default branch, required checks, bypass and plan behavior, then verify that a vulnerable pull request is blocked, remediation allows it, and cleanup removes or disables the ruleset.