Example solution: CI Security Gates
Instructor reference; attempt the student worksheet before opening the answer key.
Use the instructor walkthrough to explain policy failures versus incomplete scans. Each corrected application includes gate.mjs; the workflow links below provide complete examples for the selected package manager. Follow the track instructions for local execution and optional hosted setup. The captured before reports fail the high-severity gate and the after reports pass; missing, invalid, or incomplete reports must fail. These are reference outcomes, not proof of a hosted GitHub run.
Choose one package-manager track
The links point to the existing runnable solutions, rather than duplicate copies. Each solution includes the corrected manifest, lockfile, application, tests, and a worked remediation explanation. Use the track instructions for installation and scanning commands.
| Track | Corrected application | Explanation | Run instructions | Captured reports | Workflow |
|---|---|---|---|---|---|
| npm | Solution | Remediation | Instructions | Before/after | Workflow |
| pnpm | Solution | Remediation | Instructions | Before/after | Workflow |
| Yarn Classic | Solution | Remediation | Instructions | Before/after | Workflow |
| Yarn Berry | Solution | Remediation | Instructions | Before/after | Workflow |
| Bun | Solution | Remediation | Instructions | Before/after | Workflow |
Verify and teach the example
- Read the selected track's instructions and remediation explanation.
- Run the supplied tests and application, then scan using that track's documented commands.
- Compare actual results with the captured reports and explain any differences. Advisory data changes; do not grade against a permanently fixed finding count.
- Use the walkthrough and rubric when evaluating students' reasoning. Other justified and verified repairs can be valid.
Sharing with students
These solutions are public. For assignments where you want to withhold answers, distribute a student-only export, not the full repository. The export excludes instructor solutions and captured reports. Students may still find the public repository, so adapt graded tasks accordingly.