GitHub security workshop: Teach code scanning alert investigation and triage

[softchris]

Goal

Move beyond enabling CodeQL by teaching learners to understand, prioritize, and disposition a code scanning alert.

Scope

Build an investigation exercise around the deterministic alert from the prior lab. Cover the alert summary, severity, CWE, source-to-sink path, affected branch or pull request, status, and appropriate resolution choices. Do not rely only on screenshots or exact control positions.

Acceptance criteria

• Learners locate the alert from both the pull request/check context and repository Security experience.
• The exercise explains severity, precision, CWE, query help, data-flow steps, and affected branches.
• Learners distinguish a true positive, false positive, test-only finding, and accepted risk.
• Dismissal reasons and audit implications are explained without encouraging dismissal of the lab finding.
• Learners record a short triage decision and remediation plan.
• Plan- or role-dependent UI differences have a documented fallback.
• Completion is based on observable alert details rather than matching a screenshot.

[scubaninja]

Backlog review priority: P2. Tagging @scubaninja for visibility and follow-up.