DevSecOps workshop v0.1.2 - Codespaces primary

Codespaces-first workshop: v0.1.2 prerelease

The setup guide now follows the primary flow:

Original Pets template -> your repository -> open its codespace -> fetch the companion and run the existing setup script -> normal VS Code/Git edits.

Codespaces has already cloned the learner repository. No second clone, mandatory devcontainer, rebuild, application install, or extra core workflow is added. Local VS Code/Git and GitHub file editing are documented fallbacks after the primary path.

All live and take-home instructions now use the Codespaces editor and integrated terminal for file changes, commits, and pushes. GitHub.com remains the place for PRs, settings, Actions results, and approvals. Builds, tests, code scans, releases, and the optional token proof still execute in Actions.

The guide covers one reusable codespace, a persistent sibling kit under /workspaces, save versus commit/push, explicit stopping, storage usage, and safe recovery. It keeps Codespaces developer credentials separate from Actions job tokens. The companion fetch captures and verifies a commit before archiving that SHA, so a later editor auto-fetch cannot replace the archive source through FETCH_HEAD.

The original application template, two-core-workflow installer contract, 75-minute core plus startup/closing, and individual secret exercise remain unchanged.

Version and integrity

The annotated v0.1.2 tag resolves to companion commit:

ea050921bb902668d3e4fad5556548981c16cb91

Compare it with the commit printed by Step 0 before extracting. The ZIP contains all 52 kit files. SHA-256 of devsecops-workshop-kit-0.1.2.zip:

c9ef772ad516623dc55b62e073ad4cadad9869b522dc3a91418d62f7428c2c34

The checksum sidecar is attached. Versions v0.1.0 and v0.1.1 remain immutable.

Validation and limits

All 50 local tests passed, including a fetch regression that replaces FETCH_HEAD after verification and still extracts the correct saved commit without changing learner history. The route validator checked 25 Markdown files, 214 local links, 49 command/config snippets, and the primary/fallback boundaries. Four unchanged inert starters passed actionlint. Two kit builds produced identical bytes. Humanizer v3.0.0 File mode was applied from its pinned source to all 23 changed source Markdown files; the installed loader remains unavailable.

Actual Codespaces rehearsal was blocked before creation. The authoring CLI lacked the required codespace OAuth scope, and an authenticated browser control path was unavailable. No credentials or billing settings were changed, no additional auth consent was initiated, and no rehearsal repository or codespace was created to force the test. No Codespace ID, payer, machine, workflow-push result, secret-repair result, or stop/resume result is claimed.

The readiness register records that limitation separately from earlier local-terminal and Actions evidence. This remains a prerelease pending actual Codespaces and independent human walkthroughs, browser fallback checks, and measured learner timing.

Start with the overview or resume take-home work.

DevSecOps workshop v0.1.1 - optional workload identity

Optional workload identity: v0.1.1 prerelease

Learners can now perform a complete self-service GITHUB_TOKEN exercise in their own public repository. One job proves an expected permission denial; a separate job with only issue-write permission creates and closes a labeled training issue as github-actions[bot]. The guide includes failure classification, exact-issue cleanup, cancellation recovery, and a safe non-main negative check.

Lesson 1 now explains the GitHub App installation-token identity and job-scoped permissions. The optional lab's OIDC section links official GitHub, Azure, and AWS guidance. It distinguishes an identity assertion from provider-issued access and warns about immutable ID-bearing subjects in new repositories.

No cloud login or ID-token request is added. The two-file core setup, original Pets application template, 75-minute core, and individual secret exercise are unchanged. This is optional take-home or separately scheduled practice, not another mandatory core outcome.

Start and version integrity

Use Step 0 for v0.1.1 for the original-template and companion-fetch routes. Existing learners can open the optional guide directly; they do not need to reinstall the two core workflows.

The annotated v0.1.1 tag resolves to companion commit:

c3286ff3834c963484f5a586531644d182302826

The ZIP and checksum sidecar are attached. SHA-256 of devsecops-workshop-kit-0.1.1.zip:

40a0fdd572047f9f01caf1cce5fa973490b361ae50c9ede85f5b9bda5be90769

The 51-file archive includes all existing live/take-home materials and the optional identity starter, guide, tests, and recorded evidence. Version v0.1.0 and its assets remain unchanged.

Observed evidence

Rehearsal PR12 passed the existing required checks and CodeQL policy before merge. Main run 35688557307 confirmed the exact non-rate-limited integration HTTP 403, then HTTP 201 with the separate write-scoped job. Training issue 13 was created and closed by the bot; no unrelated issue was modified. Non-main run 35688654756 failed before API access and skipped the allowed job.

All 50 local tests passed, including 17 new permission/error/cleanup cases. Four inert starters passed actionlint. The document validator checked 25 kit Markdown files, 185 local links, and 25 command/config snippets. Two builds produced identical ZIP bytes. Humanizer v3.0.0 File mode was applied from its pinned source to every changed Markdown file; the installed skill loader remains unavailable.

This remains a rehearsal prerelease. The browser-only workflow presentation, fresh independent learner walkthroughs, and human timing remain unverified. OIDC is documentation-only guidance, not a tested cloud integration. See the readiness register for the full evidence and remaining manual gates.

DevSecOps workshop v0.1.0 — rehearsal prerelease

DevSecOps workshop v0.1.0 prerelease

The complete live and take-home kit is available for review and rehearsal. It is not yet event-ready: fresh browser-only walkthroughs, independent learner completion, and the 75-minute human timing budget remain unverified.

Create your application from the original Pets template. This companion supplies the guides, helper, workflows, fixtures, and solutions; it is not an application template.

Start with Step 0. It includes account selection, a version-pinned Git fetch/archive route, equivalent raw-file copying, security settings, and the initial PR. Only two workflows are installed during live prework. The third belongs to the facilitator and take-home release lab.

Version and integrity

The annotated v0.1.0 tag resolves to companion commit:

fac20d7cabc3bf7a1509b96f4e7e082e855d543e

Compare that value with git rev-parse 'FETCH_HEAD^{commit}' after fetching the tag as described in Step 0.

The uploaded devsecops-workshop-kit-0.1.0.zip has SHA-256:

820fe4a4ce9dacd615aa39f46227fdb338a09f3f892123c8bc81533ef418d6d9

The sidecar checksum and the kit's file inventory are included. The tested original Pets revision is d2437a6f3dbb1fe4bd5e97790ccc12c42cbfc03a.

Observed checks

The local suite passed 33 cases. Native Ubuntu and Windows Git Bash runs each passed 20 helper tests and three fetch/manifest tests. The starters passed actionlint, and the kit was built twice with identical bytes.

The authorized rehearsal observed the CodeQL debug finding and repair, dependency advisory failure and repair, an inactive GitHub Skills fixture blocked at push and repaired without bypass, enforced merge blocks, and an approved same-revision release receipt. Non-main release dispatch was rejected; manual-main execution repeated prerequisites and waited for approval.

See the readiness register for run links and remaining gates. The take-home index includes resume, merge-policy, release, dependency-maintenance, troubleshooting, and solution material.

The application and other workshops in github-samples/pets-workshop were not changed upstream. Existing dependency alerts are not claimed resolved by this workshop.