GitHub security workshop: Add a deterministic CodeQL scanning lab

未关闭

#271 创建于 2026年9月14日 1 条评论 0 个 reaction 已指派 0 人在 GitHub 查看

还没有人认领这个 Issue。

评估

难度: 4/5
预计耗时: 3-5 天
新手友好度: 50/100

Issue 类型: 功能
描述清晰度: 基本清楚
活跃度: 活跃
技术栈: github, github-actions, python
领域: documentation, security

调研方向

首先检查 pets 应用和 workshop 现有的设置指南，然后比较 CodeQL 默认设置和高级设置选项。定义一个仅用于培训的 fixture 或一个有指导的更改，并记录命名查询、严重性、文件、数据流、branch 或 pull request 触发器、验证步骤和清理流程。当警报能够可靠地出现，且不包含 secrets、无副作用、也不经过生产路径时，即视为完成。

由索引模型根据 Issue 内容生成。

描述

priority: P2

Goal

Teach learners how to enable code scanning and observe a real, intentionally introduced CodeQL finding in the pets application.

Scope

Add one safe training change that is detected reliably by a documented Python CodeQL query. The vulnerable path should be realistic enough to teach source-to-sink reasoning, but isolated from normal workshop startup and clearly marked as training-only. Provide a maintainer verification procedure so dependency or query-suite updates cannot silently break the exercise.

Acceptance criteria

The exercise explains default setup versus advanced setup and selects one tested path.
Learners enable CodeQL using current, capability-based instructions.
A training fixture or guided code change triggers a named CodeQL query deterministically.
The fixture contains no real secret, external side effect, or production deployment path.
Learners trigger analysis on a branch or pull request and can identify the resulting check.
The expected query ID, severity, file, and vulnerable data flow are documented for maintainers.
A repeatable validation step proves the expected alert appears.
Cleanup/reset instructions return the repository to a safe state.

主要语言: Python
星标: 80
派生: 161
平均合并: 31 分钟
30 天内合并 PR: 1