Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[curriculum-eval] side-quest-17-07-repo-poisoning.md: cognitive_load — 23 new concepts crammed before exercises

Cerrado Apto para principiantes
  • ¿Algo no está bien?
#3,674 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
85/100
Tipo de issue
Documentación
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
github-actions
Área
content, documentation

Línea de trabajo

Comienza con workshop/side-quest-17-07-repo-poisoning.md, especialmente con la sección «How AW Defends Against It» y sus cuatro subsecciones. Añade las comprobaciones solicitadas para cada defensa, considera recortar o mover el material no esencial, conserva los objetivos de aprendizaje y el checkpoint existentes, y ejecuta npx --yes markdownlint-cli2 "**/*.md". La tarea estará terminada cuando el archivo esté limpio según lint y se hayan abordado las cuestiones de carga cognitiva y densidad de actividad.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

curriculum documentation quality

File: workshop/side-quest-17-07-repo-poisoning.md
Overall Score: 5.0 / 10.0 (corpus mean: 6.1)

Flagged Dimensions:

Dimension Score Benchmark Delta
active_learning 2.7 ≥ activity density 3 (score 10) -7.3
cognitive_load 5.9 ≤ 800 words / ≤ 15 new concepts (score 10) -4.1

Note: the rubric also flags missing_checkpoint, but this is a confirmed tooling bug (see scorecard issue) — the file has a well-formed ## :white_check_mark: Checkpoint with 6 specific checklist items. Dismissed.

Root Cause (≤ 2 sentences):
The page introduces 23 new concepts (permissions blocks, contents: read, safe-outputs: create-pull-request, protected-files, network.allowed-domains, PR routing, path restriction, etc.) across 9 h2 sections in 1,224 words, exceeding the 15-concept cognitive-load ceiling by more than 50%. Two "Exercise" sections ask learners to identify dangerous frontmatter and harden a workflow, but at density 0.82 the surrounding defensive-technique explanations (four distinct YAML configuration patterns) are delivered as dense prose before those exercises, front-loading concepts rather than interleaving practice.

Evidence (quoted from the file):

Repository poisoning is what happens when a misdirected agent with write access commits changes an attacker designed — not changes the workflow author intended.

gh-aw gives you three layers to prevent repository poisoning.

Learning Science Rationale:
Sweller's Cognitive Load Theory predicts that presenting four distinct configuration mechanisms (read-only permissions, PR routing, path restriction, network allow-listing) as sequential prose paragraphs before any hands-on check overloads working memory, especially when each mechanism carries its own YAML syntax and rationale. Splitting the exposition into smaller worked-example chunks with immediate micro-checks (segmenting principle) would let learners consolidate each defense before the next is introduced, rather than holding all four in memory until the exercises at the bottom of the page.

Improvement Prompt (for an agent):

Edit workshop/side-quest-17-07-repo-poisoning.md to reduce cognitive load and raise activity density. Under "How AW Defends Against It," after each of the four ### subsections (Declare read-only permissions, Route writes through a pull request, Restrict which paths can change, Limit network destinations), insert a short one-line "Quick check" prompt or a 1-item micro-exercise (e.g., a code snippet to fix) tied to that specific defense, instead of leaving both exercises stacked at the end of the page. Consider trimming or moving one of the four defense subsections into a linked follow-up if it is not essential to this side quest's core objective, to bring new-concept count closer to 15-18. Keep the existing checkpoint and learning objectives unchanged. Run npx --yes markdownlint-cli2 "**/*.md" after editing.

Expected Score After Fix: 6.1 / 10.0

Generated by 🔬 Curriculum Quality Evaluator · copilot · auto · 74.5 AIC · ⌖ 11.9 AIC · ⊞ 9K · ◷

  • expires on Sep 23, 2026, 3:48 AM UTC
Lenguaje dominante
JavaScript
Estrellas
52
Forks
26
Merge medio
12 h 58 min
PR fusionados (30 d)
15

Preparar el entorno

Abrir en Codespaces

Inicia el contenedor de desarrollo del proyecto en tu navegador, con tu propia cuenta de GitHub.

  • Sin Dockerfile ni archivo de Docker Compose
  • Sin plantilla de pull request
  • Sin guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de githubnext/gh-aw-workshop

Todos los issues de githubnext/gh-aw-workshop

Issues similares

Más issues de JavaScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.