GHAS Learning Path content update (partnering with Coveros)

[BrendaThistle]

This issue is to track the updates to the GHAS Learning Path. We have outsourced the work to Coveros to do with the exception of two modules. @camihmerhar and @Chukslord1 will update the two that Coveros is not doing.

Tasks

Beta Give feedback

1. SOW/PO complete with Coveros
2. Coveros Task 1: Develop and update content to match the Objective Domain for GHAS
3. 1. Introduction to GitHub Advanced Security
4. 2. Configure Dependabot security updates on your GitHub repo
5. 3. Configure and use secret scanning in your GitHub repository
6. 4. Configure code scanning on GitHub
7. 5. Identify security vulnerabilities in your codebase on CodeQL
8. 6. Code scanning with GitHub CodeQL
9. 7. GitHub administration for GitHub Advanced Security
10. 8. Manage sensitive data and security policies within GitHub
11. Coveros Task 2: Develop and update exercises to match the Objective Domain for GHAS
12. 1. Introduction to GitHub Advanced Security
13. 2. Configure Dependabot security updates on your GitHub repo
14. 3. Configure and use secret scanning in your GitHub repository
15. 4. Configure code scanning on GitHub
16. 5. Identify security vulnerabilities in your codebase on CodeQL
17. 6. Code scanning with GitHub CodeQL
18. 7. GitHub administration for GitHub Advanced Security
19. 8. Manage sensitive data and security policies within GitHub

[BrendaThistle]

Feb 5 update:

• Cami sent over the Learning Objectives that currently map over to a MSFT module; if we're moving learning objectives around we need to map it back
• Assessment questions are currently in a YAML file; Cami will send over

Coveros update:

• Working through section by section
• Mapping it to the OD to ensure all content is covered in the modules; there can be content that is not on the exam
• Exercises are in Skills with the exception of two (code scanning):
• https://github.com/githubtraining/exercise-reference-a-codeql-query
• https://github.com/skills/introduction-to-codeql
• Assessment questions are 5-6 questions that will be at the end of the module based on the content in that module
• Reviews: would like to know when we'll get the first draft so we can schedule reviews

OD update: Under Section 4.1, we add "Describe how alerts are managed in code scanning." as 4.1.9
Brenda will post the updated OD to the Slack channel

[BrendaThistle]

Feb 20 update:

• Coveros has one module and one unit from the module updated and it's good; Phil tagged the GH team for review
• The label has been added "ready for review"
• Phil is reviewing some other PRs currently
• No blockers or issues
• Derrick has a media directory
• Goal is to have all modules done by end of March, on track

From the GH side:

• When content is ready (from Coveros) for review; just add the tag and alert
• Requesting a "SME review" tag as someone from @a-a-ron's team will review but we also want a SME review
• The two modules GH is developing, our SME recommended some updates which @camihmerhar is implementing; she'll pass it for review once finished
• Double check that the content covers the items in the Objective Domain for the exam
• Feel free to map the content to the relevant modules/exam areas

[BrendaThistle]

Mar 4 update:

• Coveros still working through the OD; have sent some review request to the GitHub team
• CCS went out
• CDS 1, 2 & 3 went out
• CDS 4 & 5, should be ready soon
• ISV question
  • Updated them but once Rachel got to the Code QL module, she found a lot of the info overlaps
  • Most of the info is covered in other places
  • Cami's recommendation is to focus more on the Code QL module as this content will be on the exam
  • Cami will check with Aaron to determine what to do with the ISV module (all of Rachel's content is done on ISV)

From the GH side:

• All good; Cami has done her reviews
• They will wait for all units are done with a specific module is done so they can review all at once
• Chuks has done his reviews
• OD mapping - noticed some of the modules have been mapped; there was one with a question mark
  • 5.1.3 seems more ambiguous; Cami said they have this covered in the modules we are doing

[camihmerhar]

Monday, March 18 update:

Coveros Update:

• Rachel is done with CSCQL and ISV and we'll be keeping both of them
  • Both modules are good to go
• CDS should be good to go
• Only managing security module is the only one Coveros needs to do
• Phil will be taking over Rachel's modules so tag him for any updates
• New unit for Managing security

GitHub Update:

• Cami to review Codescanning with CodeQL, should have a full review by Wednesday
• Joel now added to the repo (thank you again) will be reviewing Configure Dependabot security updates and Identify security vulnerabilities in your codebase
• Chuks to take Configure secret scanning and Manager sensitive data

[camihmerhar]

Monday, April 1st:

• Finished all of the modules except for MSD, Phil will ping Chuks once done so Chuks can review
• Nearly finished with the exercises, by tomorrow morning
• Will also finish the code scanning with codeql, kinda broken, it allows you to do anything, but doesn't confirm you did anything correct
• Will update exercise units name to just exercise for the codeql modules in order to follow the pattern of all of the other modules
• Also plans to finish migrating links in learning units to summary units by tomorrow as well

[Chukslord1]

Monday, April 29th:

GitHub Update:

• The team has only 3 modules left to publish
• Chuks is working on publishing for ISV and MSD
• Chuks is working on fixing hyperlinks
• Joel is working on publishing CDS

Coveros Update:

• Derrick says Phil has rounded up working on exercises