Lab 1 - refactor for private repo

Author: felickz

_labs/lab1.md

@@ -7,9 +7,9 @@ Welcome! In this lab, you will be introduced to GitHub Advanced Security (GHAS)
 > We recommend opening up two browser windows, one with the lab and one with the working copy of your repo!
 -->
 
-## Forking the repository
+## Creating the repository
 
-In this exercise, you will fork a repository with code from which you can work to test our the GHAS capabilities.
+In this exercise, you will create a repository with code from which you can work to test the GHAS capabilities.
 
 1. Navigate to +++https://github.com/Ignite-GHAS-Workshop/ghas-workshop-repo+++ in your browser.
 2. Click the green **Use this template** button in the upper right corner of the page.
@@ -44,22 +44,29 @@ Although Dependabot isn't part of the GitHub Advanced Security product suite, it
 ### Exercise 2: Enable Code Scanning
 
 1. Next, let's enable **Code Scanning with CodeQL**. These settings are also under the **Code security** settings page.
-2. Underneath the Code Scanning heading, click the **Set up** button in the **CodeQL analysis** row.
-3. There are two options: **Default** and **Advanced**. Select the **Default** option and review the settings.
+2. Click the **Enable** button next to GitHub Advanced Security.
+3. A prompt will confirm that you want to **Enable GitHub Advanced Security for this repository** - click the button.
+    - The prompt tells you how many GitHub Advanced Security licenses you would consume by enabling this feature - which is useful if you are an organization owner and want to ensure you have enough licenses for your organization.
+4. Underneath the **GitHub Advanced Security | Code scanning** heading, click the **Set up** button in the **CodeQL analysis** row.
+
+> [!NOTE]  
+> If you do not see the **Code scanning** heading on the **Code security** page after enabling **GitHub Advanced Security** -   you have likely not created your repo in the proper Organization.  Go back to the beginning of this lab and ensure you choose **Ignite24-Labs** value from the dropdown as the new repository **Owner** when you choose **Use this template** .
+
+5. There are two options: **Default** and **Advanced**. Select the **Default** option and review the settings.
     - For this lab, we will use the **Default** setup which creates a managed Actions workflow (i.e. you will not see a file committed to the repo). You can use the Advanced option to manage your code scanning workflow as a GitHub Actions workflow YAML file committed to the repo. The **Default** option is a great option to get started quickly to enable code scanning in a repository without needing to commit any additional code.
     - By default, it will scan the JavaScript code, use the default CodeQL queries (for highest precision), and scan the default branch on push, pull request, and on a weekly schedule.
 
 <details>
   ![image](images/lab-1-2-1.png)
 </details>
 
-4. Click the **Enable CodeQL** button to save the settings and enable Code Scanning.
+6. Click the **Enable CodeQL** button to save the settings and enable Code Scanning.
 
 <details>
   ![image](images/lab-1-2-2.png)
 </details>
 
-5. Ensure that **Copilot Autofix** is enabled (in the **Code Scanning --> Tools** section).
+7. Ensure that **Copilot Autofix** is enabled (in the **Code Scanning --> Tools** section).
 
 <details>
   ![image](images/lab-1-2-3.png)
@@ -68,7 +75,7 @@ Although Dependabot isn't part of the GitHub Advanced Security product suite, it
 > [!NOTE]  
 > You don't need a Copilot license in order to use the Copilot features with GitHub Advanced Security. However, Copilot can certainly be helpful in resolving issues in your IDE by using Copilot chat to explain the vulnerability and how to fix it.
 
-6. Optionally, configure the **Check runs failure threshold** - by default, a pull request will be blocked if there are any high or higher security alerts.
+8. Optionally, configure the **Check runs failure threshold** - by default, a pull request will be blocked if there are any high or higher security alerts.
 
 ### Exercise 3: Enable Secret Scanning
 
@@ -80,6 +87,7 @@ Although Dependabot isn't part of the GitHub Advanced Security product suite, it
 6. Optionally, configure **Who can bypass push protection for secret scanning**.
     - By default, as to not interrupt developers' workflows, anyone with write access to the repository can manually bypass a blocked push that contains secrets (administrators will be notified of this, and it is also captured in the audit logs).
     - In Private and internal repositories in organizations using GitHub Enterprise Cloud with GitHub Advanced Security enabled, you can change this to only allow select users/teams (or no one) to bypass secret scanning push protection.
+7. Note that you can define your own **Custom patterns** from this page to scan for secrets that don't correspond to a known provider pattern.
 
 <details>
   ![image](images/lab-1-3-1.png)