Tech check clarifications

Author: felickz

_labs/lab1.md

@@ -30,8 +30,8 @@ Dependabot and Dependency Graph should already be turned on for your repository.
 
 1. We first want to turn on the security settings for the repository. Navigate to the **Settings** tab (the icon of the gear) in the repo.
 2. Click on the  **Code security** section.
-3. Click the **Enable** button next to the **Dependency Graph** setting. To enable Dependabot, we first have to enable the Dependency Graph. This allows Dependabot to ingest your package manifest files.
-4. Click the **Enable** button next to the **Dependabot alerts** setting. This feature will create alerts for vulnerable dependencies found in your repository.
+3. Ensure the Dependency Graph is enabled.  This will be indicated by a red **Disable** button.  If there is a black **Enable** button, click it to enable the **Dependency Graph** setting. To enable Dependabot, we first have to enable the Dependency Graph. This allows Dependabot to ingest your package manifest files.
+4. Ensure the Dependabot alerts are enabled.  This will be indicated by a red **Disable** button.  If there is a black **Enable** button, click it to enable the **Dependabot alerts** setting. This feature will create alerts for vulnerable dependencies found in your repository.
 5. Click the **Enable** button next to the **Dependabot security updates** setting.
     - This will automatically create pull requests to update your vulnerable dependencies (if there is a non-vulnerable version to upgrade to).
     - Note: there is a [maximum number of pull requests that this feature will create (10)](https://docs.github.com/en/enterprise-cloud@latest/code-security/dependabot/working-with-dependabot/troubleshooting-dependabot-errors#dependabot-cannot-open-any-more-pull-requests).
@@ -44,32 +44,31 @@ Dependabot and Dependency Graph should already be turned on for your repository.
 
 Once you are done turning on Dependabot features, the next thing we will need to do is turn on GitHub Advanced Security.
 
-### Exercise 2: Enable Code Scanning
+### Exercise 2: Enable Advanced Security and Code Scanning
 
 1. Next, let's enable **Code Scanning with CodeQL**. These settings are also under the **Code security** settings page.
-2. Click the **Enable** button next to GitHub Advanced Security.
-3. A prompt will confirm that you want to **Enable GitHub Advanced Security for this repository** - click the button.
+2. Ensure GitHub Advanced Security is enabled.  This will be indicated by a red **Disable** button.  If there is a black **Enable** button, click it to enable **GitHub Advanced Security**.  A prompt will confirm that you want to **Enable GitHub Advanced Security for this repository** - click the button.
     - The prompt tells you how many GitHub Advanced Security licenses you would consume by enabling this feature - which is useful if you are an organization owner and want to ensure you have enough licenses for your organization.
-4. Underneath the **GitHub Advanced Security | Code scanning** heading, click the **Set up** button in the **CodeQL analysis** row.
+3. Underneath the **GitHub Advanced Security | Code scanning** heading, click the **Set up** button in the **CodeQL analysis** row.
 
 > [!NOTE]  
 > If you do not see the **Code scanning** heading on the **Code security** page after enabling **GitHub Advanced Security** - you have likely not created your repo in the proper Organization. Go back to the beginning of this lab and ensure you choose **Ignite24-Labs** value from the dropdown as the new repository **Owner** when you choose **Use this template**.
 
-5. There are two options: **Default** and **Advanced**. Select the **Default** option and review the settings.
+4. There are two options: **Default** and **Advanced**. Select the **Default** option and review the settings.
     - For this lab, we will use the **Default** setup, which creates a managed Actions workflow (i.e. you will not see a codeql.yaml file committed to the repo). You can use the Advanced option to manage your code scanning workflow as a GitHub Actions workflow YAML file committed to the repo. The **Default** option is a great option to get started quickly to enable code scanning in a repository without needing to commit any additional code.
     - By default, it will scan the JavaScript code, use the default CodeQL queries (for highest precision), and scan the default branch on push, pull request, and on a weekly schedule.
 
 <details>
   ![image](images/lab-1-2-1.png)
 </details>
 
-6. Click the **Enable CodeQL** button to save the settings and enable Code Scanning.
+5. Click the **Enable CodeQL** button to save the settings and enable Code Scanning.
 
 <details>
   ![image](images/lab-1-2-2.png)
 </details>
 
-7. Ensure that **Copilot Autofix** is enabled (in the **Code Scanning --> Tools** section).
+6. Ensure that **Copilot Autofix** slider is enabled as **On |** (in the **Code Scanning --> Tools** section).
 
 <details>
   ![image](images/lab-1-2-3.png)
@@ -82,7 +81,7 @@ Once you are done turning on Dependabot features, the next thing we will need to
 
 ### Exercise 3: Enable Secret Scanning
 
-1. Click on the **Enable** button to enable Secret Scanning.
+1. Ensure that Secret Scanning is enabled.  This will be indicated by a red **Disable** button.  If there is a black **Enable** button, click it to enable **Secret Scanning**.
 2. Check the box to **Scan for generic secrets**. This feature uses AI to find secrets/passwords that may be in your code that do not correspond to a known provider pattern.
 3. Click the **Enable** button next to the **Validity checks** setting. This feature checks if the secret is still valid for [specific partners](https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/introduction/supported-secret-scanning-patterns#high-confidence-patterns), such as Azure, AWS, and, of course, GitHub. As an example, you can use this feature to check if a GitHub personal access token found in the repo is still valid and needs to be revoked.
 4. Click the **Enable** button next to the **Non-provider patterns** setting. This scans for patterns that do not correspond to partners but still have a common syntax, such as a MySQL or MongoDB connection string.