Teaching plan
Preparation and learning goals
Require Exercise 01 or equivalent dependency-remediation knowledge. Preflight a selected manager's kit. The local route needs no GitHub account. Synthetic high/clean/incomplete reports are supplied in scenarios/; historical application scans and provenance are in reference-reports/.
Teach the worksheet's definitions of CI, workflow, gate and exit code. Teach least privilege before grading it: the provided job needs to read repository code, not push changes, so contents: read is sufficient. Every student can inspect and explain that setting without a hosted run.
Suggested sequence
Allow about 30 minutes as a follow-on to 01, or 45–60 minutes for prepared students new to gates. Setup and optional hosted GitHub work take additional time. Adjust the pace to your students’ experience.
| Stage | Follow-on time | Checkpoint |
|---|---|---|
| Explain policy, exits and read-only permissions | 5 min | Separate permission limits from severity thresholds. |
| Predict/run synthetic cases and initial app gate | 10 min | Distinguish helper exits 1/0/2; preserve actual evidence. |
| Reviewed repair, tests and rescan/gate | 10 min | Passing depends on complete data and policy, not suppressing errors. |
| Explain and submit | 5 min | Complete scenario and application tables plus policy questions. |
For the longer route, allow discussion and time to inspect each output. Hosted Git/YAML/Actions setup is optional and not squeezed into these times.
Answer and assessment checkpoints
Synthetic high.json blocks with 1; clean.json passes with 0; incomplete.json requires review with 2 even though no findings are listed. These are helper conventions, not a promise that every scanner failure has the same codes. Never represent the synthetic files as scanner output.
Use the independent 20-point rubric and dedicated submission template. Local and hosted paths earn the same maximum. Least privilege and policy limitations are taught and assessed on both paths. In offline mode, helper scenarios can run with Node; use historical reports for the application comparison, marking unperformed live scans explicitly. No classroom credit depends on creating a public repository or paying for CI.