Skip to content

Commit 241c0a1

Browse files
narasimhakudvanarasimhakudva
committed
manuals
1 parent eb6ed09 commit 241c0a1

File tree

8 files changed

+269
-0
lines changed

8 files changed

+269
-0
lines changed

labs/Git-setup.md renamed to labs/1.Git-setup.md

File renamed without changes.

‎labs/2-projects.md‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# 2 Create a Project and a Sprint!
2+
3+
In this hands-on lab you will use GitHub's new Project experience to create a project to track issues and set up an agile style iterative process using sprints. Good luck! 👍
4+
5+
This hands on lab consists of the following steps:
6+
- [Create Issues in the repository](#create-issues-in-the-repository)
7+
- [Create a new Project](#create-a-new-project)
8+
- [Setup and view your sprint](#setup-and-view-your-sprint)
9+
10+
## Create Issues in the repository
11+
1. Work inside your current repository `Microsoft-Bootcamp/attendee-<your-github-handle>`.
12+
2. Click `Issues`.
13+
3. Click `New issue` on the right hand side of the page.
14+
4. Enter a `Title`. Suggestion: `Create a login page`.
15+
5. Enter a comment in `Leave a comment`. Suggestion:
16+
```
17+
# My first Issue!
18+
- [ ] Create a login page for the website
19+
20+
```
21+
6. Create 3 more issues. Get creative and make them your own.
22+
23+
## Create a new Project
24+
1. Work inside your current repository `Microsoft-Bootcamp/attendee-<your-github-handle>`.
25+
2. Click `Projects`.
26+
3. Click the down arrow next to `Link a project`.
27+
4. Select `New project`.
28+
5. Click `New project`.
29+
6. The `Select a template` dialog appears.
30+
7. Under `Project name` type your GitHub handle and then `my first project`. The title will look like `@<your-handle> my first project`.
31+
8. Verify `Table` is selected and click `Create`.
32+
9. Click `Add item from repository`.
33+
10. Select your repository from the drop-down list.
34+
11. Select the four issues your just created.
35+
12. Click `Add selected items`.
36+
37+
## Setup and view your sprint
38+
1. Click `New view, layout `Table`. This will be visible inside the project just created.
39+
2. Name the view `Sprint view`.
40+
3. Add a new field. Click the `+` sign next to the `Status` column.
41+
4. Click `New field` in the dialog box.
42+
5. Name the field `Sprint`.
43+
6. In the `Field type` select `Iteration`. Accept the defaults. You might have to rename the field to `Sprint` again.
44+
7. Click `Save and create`.
45+
8. Assign the first two Issues to `Sprint 1`.
46+
9. The third issue to `Sprint 2`.
47+
10. The fourth issue to `Sprint 3`.
48+
11. Under the `Sprint view` dropdown select `Group` then `Sprint`. The project should group by sprint.
49+
12. Save the changes to `Sprint view`.
50+
51+

labs/issues and pull requests.md renamed to labs/2.1issues and pull requests.md

File renamed without changes.

labs/GitHub-Actions-Training-Manual.md renamed to labs/3.1GitHub-Actions-Training-Manual.md

File renamed without changes.

labs/Github.actions.md renamed to labs/3.Github.actions.md

File renamed without changes.

‎labs/4-dependabot.md‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
# 7 Enabling and using Dependabot on your repository
2+
The hands-on lab has the goal to learn you how to enable the Dependency and Dependabot features and gain hands-on experience with Dependatbot's ability to update your dependencies automatically.
3+
4+
This hands on lab consists of the following steps:
5+
- [Enabling the Dependency features](#enabling-the-dependency-features)
6+
- [Dependabot alerts](#dependabot-alerts)
7+
- [If time permits: Always assign Dependabot alerts to a person for review](#if-time-permits-always-assign-dependabot-alerts-to-a-person-for-review)
8+
9+
## Enabling the Dependency features
10+
Let's start with enabling the following features on your repository. When you navigate to the `Settings` tab on your repository, under the `Configure security and analysis features` you will find the following features. Go ahead and click `Enable` for each of these features:
11+
* Dependency graph
12+
* Dependabot alerts
13+
* Dependabot security updates
14+
15+
![Dependabot - Enabling settings](../images/dependabotsettings.PNG)
16+
17+
Now that you have enabled the Dependabot features, let's have some hands-on experience with this functionality.
18+
19+
## Dependabot alerts
20+
Dependabot alerts track security vulnerabilities that apply to your repository’s dependencies. When you navigate to the `Security` tab on your repository, and click `Dependabot alerts`, you can see the active alerts generated by Dependabot.
21+
22+
![Dependabot - Alerts](../images/dependabotalerts.PNG)
23+
24+
When you click on an alert, you can see the details on that alert. Let's have a look at an example alert. Dependabot will show you details on the vulnerability and a suggested remediation. Review the details of the vulnerability and, if available, the pull request containing the automated security update. Optionally, if there isn't already a Dependabot security updates update for the alert, to create a pull request to resolve the vulnerability, click `Create Dependabot security update`.
25+
26+
![Dependabot - Alert details](../images/dependabotalertdetails.PNG)
27+
28+
A pull request with regards to a security update will always be generated by the Dependabot bot user. Navigate to the pull request that was generated by the Dependabot bot user. Here's an example:
29+
30+
![Dependabot - Generated pull request](../images/dependabotpullrequest.PNG)
31+
32+
When you're ready to update your dependency and resolve the vulnerability, merge the pull request.
33+
34+
## If time permits: Always assign Dependabot alerts to a person for review
35+
By default, Dependabot raises pull requests without any reviewers or assignees. In this part of the hands-on lab, let's make use of the ability to configure Dependabot to always assign Dependabot alerts to a person. You can perform this kind of configuration using the `dependabot.yml` file. You must store this file in the `.github` directory of your repository. When you add or update the `dependabot.yml` file, this triggers an immediate check for version updates.
36+
37+
You can use reviewers and assignees to specify reviewers and assignees for all pull requests raised. You can also specify a team but when you specify a team, you must use the full team name, as if you were @mentioning the team (including the organization).
38+
39+
The example `dependabot.yml` file below changes the npm configuration so that all pull requests opened with version and security updates for npm will have two reviewers and one assignee.
40+
41+
```
42+
# dependabot.yml file with
43+
# reviews and an assignee for all npm pull requests
44+
45+
version: 2
46+
updates:
47+
# Keep npm dependencies up to date
48+
- package-ecosystem: "nuget"
49+
directory: "/code/"
50+
schedule:
51+
interval: "daily"
52+
# Raise all npm pull requests with reviewers
53+
# Enter your GitHub username
54+
reviewers:
55+
- "user-name"
56+
# Raise all npm pull requests with an assignee
57+
# Enter your GitHub username
58+
assignees:
59+
- "user-name"
60+
```
61+
62+
Now, go ahead and try to always assign Dependabot alerts to yourself using configuration via the `dependabot.yml` file.
63+
64+
For more information, please refer to: [https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/customizing-dependency-updates](https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/customizing-dependency-updates)

‎labs/5-secretscanning.md‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
# 8 Setting up Secret Scanning for your repository
2+
In this lab you will:
3+
- Learn how to enable secret scanning
4+
- Experience how secret scanning scans your repository for known types of secrets
5+
- Learn the capabilities of secret scanning that help to prevent fraudulent use
6+
7+
Good luck! 👍
8+
9+
This hands on lab consists of the following steps:
10+
- [Secret Scanning: What is it?](#secret-scanning-what-is-it)
11+
- [Enabling Secret Scaning functionality](#enabling-secret-scanning-functionality)
12+
- [Triggering Push Protection by trying to add a GitHub Token as a connection string](#triggering-push-protection-by-trying-to-add-a-github-token-as-a-connection-string)
13+
- [Triggering Secret Scanning by inserting an unwanted exposed email address](#triggering-secret-scanning-by-inserting-an-unwanted-exposed-email-address)
14+
15+
## Enabling GitHub Advanced Security on your repository
16+
Should GitHub Advanced Security not be enabled yet on your repository, you can enable it from the `Settings` menu on your repository, then under `Security & Analysis`, in the section `GitHub Advanced Security`, click `Enable`. Advanced Security should be enabled in order to enable Code Scanning and Secret Scanning.
17+
18+
## Secret Scanning: What is it?
19+
If your project communicates with an external service, you might use a token or private key for authentication. Tokens and private keys are examples of secrets that a service provider can issue. If you check a secret into a repository, anyone who has read access to the repository can use the secret to access the external service with your privileges. We recommend that you store secrets in a dedicated, secure location outside of the repository for your project.
20+
21+
Secret scanning will scan your entire Git history on all branches present in your GitHub repository for any secrets. Service providers can partner with GitHub to provide their secret formats for scanning. For more information, see "Secret scanning partner program."
22+
23+
If someone checks a secret with a known pattern into a public or private repository on GitHub, secret scanning catches the secret as it's checked in, and helps you mitigate the impact of the leak. Repository administrators are notified about any that contains a secret, and they can quickly view all detected secrets in the Security tab for the repository.
24+
25+
For GitHub Secret SCanning documentation, please refer to: [https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning](https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning)
26+
27+
### Enabling Secret Scanning functionality
28+
Depending on your GitHub settings Secret Scanning may already be enabled. To turn GitHub Secret Scanning, please navigate to the `Settings` of your repository, click `Security & analysis` click `Enable` for the `Secret Scanning` feature.
29+
30+
![Secret Scanning - Enable](../images/secretscanningenable.PNG)
31+
32+
Secret Scanning and Push Protection is now enabled for your repository.
33+
34+
### Triggering Push Protection by trying to add a GitHub Token as a connection string.
35+
You can trigger the Secret Scanning Push Protection functionality by inserting a secret in your repository yourself. To do so, try if you can manage to execute the following steps:
36+
* Locate the GitHub PAT you created during the Codespace exercise OR create a new PAT
37+
* Go back to your code
38+
* Open the file `/code/src/AttendeeSite/appsettings.json`,
39+
* At the end of the file, append the file with a `ConnectionString` element and paste the copied GitHub PAT.
40+
* The file should look like this:
41+
```
42+
{
43+
"Logging": {
44+
"LogLevel": {
45+
"Default": "Information",
46+
"Microsoft": "Warning",
47+
"Microsoft.Hosting.Lifetime": "Information"
48+
}
49+
},
50+
"AllowedHosts": "*",
51+
"ConnectionString": "PASTE GITHUB PAT"
52+
}
53+
```
54+
* Try and commit your changes and see whether you will be able to. Push protection should stop the commit before it happens.
55+
56+
### Triggering Secret Scanning by inserting an unwanted exposed email address
57+
* Go back to your code view of the repository
58+
* Open the file `/code/readme.md` (create if if does not exist)
59+
* Add some text to the file:
60+
```
61+
# Technical Support
62+
For Technical Support please contact: [email protected]
63+
```
64+
* Commit your changes to main.
65+
* Go to `Settings`
66+
* Go to `Code security & analysis`
67+
* Under `Secret Scanning` and `Custom patterns` click `New pattern`
68+
* Name the pattern `Custom Email Check`
69+
* Under `Secret format` add `\b[a-zA-Z0-9._%+-]+@domain\.onmicrosoft\.com\b`
70+
* Add `[email protected]` to the `Test pattern` box and see it's not a match
71+
* Add `[email protected]` to the `Test pattern` box and see it's a match
72+
* Click `Security & Analysis` at the top
73+
* Click `edit` for the new custom pattern
74+
* Scroll down and click `Publish pattern`
75+
* Click on the `Security` tab and view the Secret alert.
76+
77+
### Fix the Security Alert
78+
* Go back to your landing page of your repositry
79+
* Select the `Security` tab at the top
80+
* Click on your Secret alert
81+
* View the alert
82+
* Select `False Positive` to turn alert off.

‎labs/6-codescanning.md‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
# 9 Setting up Code Scanning for your repository
2+
In this lab you will:
3+
- Learn how to set up code scanning for repositories
4+
- Experience how code scanning enables you to find security vulnerabilities
5+
6+
Good luck! 👍
7+
8+
This hands on lab consists of the following steps:
9+
- [Enabling GitHub Advanced Security on your repository](#enabling-github-advanced-security-on-your-repository)
10+
- [Code Scanning: What is it?](#code-scanning-what-is-it)
11+
- [Enabling the Code Scanning functionality](#enabling-the-code-scanning-functionality)
12+
- [Analyzing Code Scanning outcomes](#analyzing-code-scanning-outcomes)
13+
14+
## Enabling GitHub Advanced Security on your repository
15+
Should GitHub Advanced Security not be enabled yet on your repository, you can enable it from the `Settings` menu on your repository, then under `Security & Analysis`, in the section `GitHub Advanced Security`, click `Enable`. Advanced Security should be enabled in order to enable Code Scanning and Secret Scanning.
16+
17+
![Advanced Security - Enable](../images/advancedsecurityenable.PNG)
18+
19+
## Code Scanning: What is it?
20+
Code scanning is a feature that you use to analyze the code in a GitHub repository to find security vulnerabilities and coding errors. Any problems identified by the analysis are shown in GitHub.
21+
22+
You can use code scanning to find, triage, and prioritize fixes for existing problems in your code. Code scanning also prevents developers from introducing new problems. You can schedule scans for specific days and times, or trigger scans when a specific event occurs in the repository, such as a push. If code scanning finds a potential vulnerability or error in your code, GitHub displays an alert in the repository. After you fix the code that triggered the alert, GitHub closes the alert. For more information, see [Managing code scanning alerts for your repository](https://docs.github.com/en/code-security/secure-coding/managing-code-scanning-alerts-for-your-repository]).
23+
24+
For GitHub Code Scanning documentation, please refer to: [https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning](https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning)
25+
26+
### Enabling the Code Scanning functionality
27+
To enable GitHub Code Scanning, please navigate to the `Settings` of your repository, click `Security & analysis` click the `Set up` drop down for the `Code Scanning` feature and choose "Advanced".
28+
29+
![Code Scanning - Set up](../images/codescanningsetup.PNG)
30+
31+
You'll be directed to the insert a new file that runs code scanning by using the *CodeQL Analysis* product maintained by GitHub.
32+
33+
![Code Scanning - Get started](../images/getstartedwithcodescanning.PNG)
34+
35+
After this step, a `codeql.yml` file is generated for you. For most projects, this workflow file will not need changes; you can simply commit it to your repository.
36+
37+
![Code Scanning - Commit](../images/codescanningcommit.PNG)
38+
39+
Once your changes are committed, you will see the `codeql.yml` file in the (new) directory `./github/workflows`.
40+
41+
![Code Scanning - CodeQL Analysis Workflow](../images/codeqlanalysisyml.PNG)
42+
43+
When you click the file `codeql.yml`, you get to see the option `View runs`.
44+
45+
![Code Scanning - CodeQL view runs](../images/codeqlviewruns.PNG)
46+
47+
From here, you can see the list of workflows with the CodeQL workflow and the run history of the CodeQL workflow. In the default CodeQL analysis workflow, code scanning is configured to analyze your code each time you either push a change to the default branch or any protected branches, or raise a pull request against the default branch. As a result, code scanning will now commence. As you can see on the below screenshot, the workflow is currently running.
48+
49+
![Code Scanning - CodeQL run history](../images/codeqlrunhistory.PNG)
50+
51+
Reviewing any failed analysis job
52+
53+
After some minutes, generally around 7 to 8 minutes, the workflow run will be completed and you will see the status being updated.
54+
55+
![Code Scanning - CodeQL views runs (completed)](../images/codeqlviewruns_completed.PNG)
56+
57+
Clicking through on the workflow run, by clicking on `Create codeql.yml`, you can see the details of the workflow run.
58+
59+
![Code Scanning - CodeQL workflow completed](../images/codeqlworkflow_completed.PNG)
60+
61+
Great, now that your CodeQL workflow is completed, we can move on and discover the way your Code Scanning outcomes can be analyzed.
62+
63+
### Analyzing Code Scanning outcomes
64+
When you navigate to the `Security` tab on your repository, and click `Code Scanning alerts`, you can see the active alerts for Code Scanning. From this view, you can view, fix, dismiss, or delete alerts for potential vulnerabilities or errors in your project's code.
65+
66+
![Code Scanning - Security Tab](../images/codescanning_securitytab.PNG)
67+
68+
Each alert highlights a problem with the code and the name of the tool that identified it. You can see the line of code that triggered the alert, as well as properties of the alert, such as the severity, security severity, and the nature of the problem. Alerts also tell you when the issue was first introduced. For alerts identified by CodeQL analysis, you will also see information on how to fix the problem.
69+
70+
![Code Scanning - Alerts details](../images/codescanningalertdetails.PNG)
71+
72+
For more detailed information on managing the Code Scanning alerts, refer to: [https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/managing-code-scanning-alerts-for-your-repository](https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/managing-code-scanning-alerts-for-your-repository)

0 commit comments

Comments
 (0)