Environment Setup

Complete all steps below before starting the exercises.

4.1 Create Enterprise Organization

1. Log in to your GitHub Enterprise Cloud account at your GHE.com subdomain
2. Navigate to Enterprise settings → Organizations → New organization
3. Create a new organization (e.g., trust-boundary-workshop)
4. During creation, select Japan as the Data Residency region
5. Verify the organization is created under your *.ghe.com subdomain URL

# Your organization URL will look like:
https://YOUR-ENTERPRISE.ghe.com/organizations/trust-boundary-workshop

Note: GHE.com is the dedicated domain for GitHub Enterprise Cloud with Data Residency. It is separate from github.com and has its own subdomain for each enterprise.

4.2 Configure Managed User Accounts (EMUs)

1. Navigate to Enterprise settings → People → Members
2. Provision at least two EMU test users via your Identity Provider (IdP):
   • TestUser1 — assign Admin role on the organization
   • TestUser2 — assign Member role on the organization
3. Verify both users can log in to the GHE.com subdomain

Important: EMU accounts are fully managed by the enterprise. Key restrictions:

• ❌ Cannot fork repositories outside the enterprise
• ❌ Cannot create public repositories
• ❌ Cannot contribute to open-source repos on the same platform
• ✅ All actions are governed by enterprise policy

4.3 Create Organization-Owned Repository

1. As TestUser1 (Admin), navigate to your organization
2. Click New repository
3. Configure:
   • Name: trust-boundary-demo
   • Visibility: Private
   • Default branch: main
   • Initialize: Add a README
4. Clone the repository and copy the sample application from this workshop template:

# Clone the new repository
git clone https://YOUR-ENTERPRISE.ghe.com/trust-boundary-workshop/trust-boundary-demo.git
cd trust-boundary-demo

# Copy the sample application from this workshop repo
# (app.py and tests/ are already included in this template repository)
cp /path/to/agentic-devsecops-trust-boundry/app.py .
cp /path/to/agentic-devsecops-trust-boundry/requirements.txt .
cp -r /path/to/agentic-devsecops-trust-boundry/tests .
cp -r /path/to/agentic-devsecops-trust-boundry/.github .

1. Review the sample application (app.py):

# app.py — minimal sample application
import os

def get_config():
    """Read configuration from environment variables."""
    port = int(os.getenv("APP_PORT", "8080"))
    if not (1 <= port <= 65535):
        raise ValueError(f"APP_PORT must be between 1 and 65535, got {port}")
    return {
        "app_name": os.getenv("APP_NAME", "trust-boundary-demo"),
        "environment": os.getenv("APP_ENV", "development"),
        "port": port,
    }

1. Push the sample application to the repository:

git add app.py requirements.txt tests/ .github/
git commit -m "Add sample application and workshop files"
git push origin main

4.4 Configure Branch Protections (Access Control)

1. Navigate to Settings → Branches → Branch protection rules
2. Click Add branch protection rule
3. Configure for the main branch:

Warning: Do NOT enable “Require status checks to pass before merging” at this point. Required status checks (CodeQL, dependency review, etc.) are part of Workshop 2 — Secure by Design Guardrails. In this workshop, branch protections serve as access control only.

4.5 Enable Minimal Security Features

1. Navigate to Settings → Code security and analysis
2. Enable:
   • ✅ Secret scanning — Detects exposed secrets in the repository
3. Leave the following disabled for now:
   • ❌ CodeQL analysis — Configured in Workshop 2
   • ❌ Dependency review — Configured in Workshop 2
   • ❌ Secret scanning push protection — Configured in Workshop 2

Important: Full GHAS (GitHub Advanced Security) is configured in Workshop 2. In this workshop, we enable only secret scanning to demonstrate that security features exist within the trust boundary. The full security configuration is intentionally deferred.

4.6 Enable Copilot

1. Navigate to Organization settings → Copilot → Access
2. Enable GitHub Copilot for the organization
3. Assign Copilot licenses to both EMU test users
4. Navigate to Organization settings → Copilot → Policies:
   • ✅ Enable Copilot Chat
   • ✅ Enable Copilot coding agent
5. Navigate to the trust-boundary-demo repository:
   • Settings → Copilot → Coding agent → Enable

# Verify Copilot access via CLI
gh copilot --version

4.7 Network & Access Control

1. SSO / IdP: Ensure SAML SSO is configured and enforced for the enterprise
2. MFA: Enforce multi-factor authentication for all enterprise members
3. IP allowlist (if required): Navigate to Enterprise settings → Authentication security → IP allow list and add your corporate network ranges

Tip: For this workshop, ensure your network allows access to your GHE.com subdomain. If you’re behind a corporate proxy, add *.ghe.com to your allowlist.

Verify Setup

Tip: Run scripts/verify-setup.sh after completing all setup steps to confirm your environment is ready.

./scripts/verify-setup.sh