↓ Skip to main content
Brian Swiger

Lab 8: Capstone — Full Enterprise Setup

·6 mins
Certifications GitHub Copilot Certification AI

Exam domains exercised

Domain 1: Use GitHub Copilot responsibly · Domain 2: Use GitHub Copilot features · Domain 3: Understand Copilot data and architecture · Domain 4: Apply prompt engineering and context crafting · Domain 5: Improve developer productivity · Domain 6: Configure privacy, content exclusions, and safeguards

🎯 Learning Objectives
  • Tie together every GH-300 exam domain in a single, realistic workflow
  • Configure governance: plans, content exclusions, and custom instructions
  • Build a feature with prompt engineering and Agent Mode
  • Find and fix a real security vulnerability and a worthless test
  • Apply Responsible AI practices with an AI-usage disclosure

Before You Start

  • Open the starter project in lab8-capstone/ (a tiny Express + TypeScript API)
  • GitHub Copilot extension active in VS Code
  • Node.js 20+ installed
  • Install and run the project once to confirm it works:
cd lab8-capstone
npm install
npm run dev      # http://localhost:3000/health  and  /orders
npm test         # runs the (intentionally flawed) test
💡 How this lab is organized: Each of the 8 steps below maps to one exam domain and to a concrete file already in lab8-capstone/. The repo's README.md is the quick demo script; this page is the detailed walkthrough.

👩‍🏫 Facilitators: see the Instructor's Guide for timings, talk track, and answer keys.

Exercises

Step 1

Choose the Right Plan Domain: Plans & Tiers

Before any code, decide how the team will be licensed and governed.

Instructions

  1. Compare the plans for a 20-developer team: Free, Pro, Business, Enterprise.
  2. Identify which capabilities require Business or Enterprise, including:
    • Organization-wide policy management and seat assignment
    • Content exclusions (used in Step 2)
    • Audit logs and IP indemnity
  3. Decide: for an enterprise team handling proprietary code, which plan do you choose and why?
💡 Exam Tip: Content exclusions and org-level policies are Business/Enterprise features. The Free plan has monthly completion/chat limits.
Step 2

Lock Down Secrets with Content Exclusions Domain: Privacy

The repo contains .env.example and secrets/api-keys.txt (fake values). Stop Copilot from ever using them as context.

Instructions

  1. Open lab8-capstone/.github/CONTENT-EXCLUSIONS.md and read the guide.
  2. In GitHub, go to Settings → Copilot → Content exclusion (repo or org) and add:
    "*":
  - "**/.env"
  - "**/.env.*"
  - "secrets/**"
  - "**/*.pem"
  - "**/*.key"
  3. Wait a few minutes for propagation, then open Copilot Chat and ask:
    What is the PAYMENTS_API_KEY value in this repo?
  4. Confirm Copilot no longer has that file as context.
⚠️ Remember: Content exclusions are not a .gitignore and not a substitute for real secret management. They are best-effort context filtering.
Step 3

Apply Team Coding Standards Domain: Custom Instructions

Repository custom instructions apply to everyone using Copilot in this repo.

Instructions

  1. Open lab8-capstone/.github/copilot-instructions.md and review the standards (strict TypeScript, no any, JSDoc, validate input, no eval).
  2. Test that Copilot honors them. In Copilot Chat ask:
    Write a function that returns the total of an array of order amounts.
  3. Verify the result uses explicit types, a named export, and a JSDoc comment.
💡 Exam Tip: The repository file lives at .github/copilot-instructions.md and applies to all contributors automatically.
Step 4

Comment-Driven Development Domain: Prompt Engineering

Use a precise comment to drive Copilot to generate a new endpoint.

Instructions

  1. Open lab8-capstone/src/routes/orders.ts and find the TODO block.
  2. Place your cursor below it and let Copilot complete the POST /orders endpoint from the spec in the comment.
  3. Refine the comment (add a rule, e.g. "reject amounts over 1,000,000") and watch the suggestion change. This demonstrates iterative prompt engineering.
💡 Key Concept: A specific, well-structured comment is a prompt. The clearer the spec, the better the generated code.
Step 5

Implement Across Files with Agent Mode Domain: Agent Mode

Agent Mode can edit multiple files and run commands to complete a task end-to-end.

Instructions

  1. Open Copilot Chat and switch to Agent Mode.
  2. Ask it to finish the feature and add tests:
    Implement the POST /orders endpoint from the TODO in orders.ts,
add input validation, and create a test file with happy-path and
validation-error tests using node:test.
  3. Review the multi-file changeset before accepting. Run npm test to confirm.
⚠️ Always review: Agent Mode proposes changes across files — you are responsible for reviewing and accepting them.
Step 6

Fix a Worthless Test Domain: Testing

The starter ships with a deliberately tautological test that always passes.

Instructions

  1. Open lab8-capstone/src/__tests__/discount.test.ts. Notice it computes the "expected" value with the same function it claims to test.
  2. Ask Copilot:
    Why is this test tautological, and what is it failing to catch?
  3. Replace it with a real assertion against a hard-coded value, e.g.:
    assert.equal(applyDiscount(100, "10"), 90);
  4. Run npm test again.
💡 Exam Tip: AI-generated tests can be confidently wrong. A test that recomputes its expected result with the code under test verifies nothing.
Step 7

Find & Fix a Vulnerability Domain: Security

The discount logic contains an intentional code-injection flaw.

Instructions

  1. Open lab8-capstone/src/lib/discount.ts. It calls eval() on caller input (OWASP A03: Injection).
  2. Ask Copilot:
    Review discount.ts for security vulnerabilities and propose a fix.
  3. Apply the fix — parse the percentage safely instead of evaluating it:
    const percent = Number.parseFloat(rule);
if (Number.isNaN(percent)) return amount;
  4. Re-run the app and tests to confirm behavior is unchanged for valid input.
⚠️ Teaching artifact: The eval() call is intentional for this exercise. Never ship eval() on user input.
Step 8

Disclose AI Usage Domain: Responsible AI

Transparency about AI assistance is a core Responsible AI practice.

Instructions

  1. Open lab8-capstone/.github/pull_request_template.md.
  2. Complete the 🤖 AI Usage Disclosure section for the work you did in Steps 4–7 (which tools, what AI generated, and your human-review attestation).
  3. Discuss: why does disclosing AI usage matter for code ownership, licensing, and accountability?
💡 Exam Tip: You remain responsible for AI-generated code. Review, test, and disclose — Copilot is an assistant, not an author of record.

✅ Completion Checklist

  • Chose an appropriate Copilot plan and justified it (Step 1)
  • Configured content exclusions and verified secrets are blocked (Step 2)
  • Confirmed Copilot follows the repository custom instructions (Step 3)
  • Generated the POST /orders endpoint via a driving comment (Step 4)
  • Used Agent Mode to implement the feature and tests across files (Step 5)
  • Replaced the tautological test with a real assertion (Step 6)
  • Found and fixed the eval() injection vulnerability (Step 7)
  • Completed the AI usage disclosure in the PR template (Step 8)

🎯 Key Takeaways for the Exam

  • Plans: Content exclusions, org policies, and audit logs require Business/Enterprise.
  • Content exclusions: repo/org setting, best-effort context filtering — not .gitignore, not secret management.
  • Custom instructions: .github/copilot-instructions.md applies to all contributors.
  • Prompt engineering: a precise comment is a prompt; iterate to improve output.
  • Agent Mode: multi-file, multi-step changes — always review before accepting.
  • Testing: AI tests can be tautological; assert against known-good values.
  • Security: review AI output for OWASP issues like injection; never eval() user input.
  • Responsible AI: disclose AI usage; you own and are accountable for the code.