feat(security): onboard security-suite (secret + CodeQL) scanning. - #2589
Open
gmanal wants to merge 1 commit into
Open
feat(security): onboard security-suite (secret + CodeQL) scanning.#2589gmanal wants to merge 1 commit into
gmanal wants to merge 1 commit into
Conversation
Call the centrally maintained NVIDIA/security-workflows security suite rather than wiring each scan separately: one pinned reference runs the Pulse secret scan and CodeQL SAST, both explicitly enabled. Replace .github/workflows/codeql.yml with the suite's SAST scan. Both publish code scanning results under the category /language:python, so keeping the local workflow would put two analyses on every commit that overwrite each other's alerts. The suite performs the same analysis: python, build-mode none, security-extended queries, on ubuntu-latest.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Onboard NVIDIA security scanning to cuda-python using the centrally maintained NVIDIA/security-workflows surfaces. This uses the security suite — a single pinned reusable workflow that fans out to the individual scanners — rather than one caller per scan. Two complementary controls:
secret-scan-trufflehogpre-commit hook — catches credentials before commit.Every scan in the suite is opt-in, so this repository runs exactly the two scans named here; scanners added upstream later will not switch on by themselves.
Changes
.github/workflows/security-suite.ymlcalling the centralized security suite, onmain,ctk-next, and copy-pr-botpull-request/*branches; the secret scan runs onnv-cpu-general(onboarded for this repo in the enterprise runner config) via thelinux-amd64-cpu4label.enable-secret-scan: trueandenable-sast-scan: true— so what runs here is visible in this file rather than inherited from upstream defaults..github/workflows/codeql.yml, superseded by the suite's SAST scan. Both publish code scanning results under the category/language:python, so running them together would put two analyses on every commit that overwrite each other's alerts. The suite performs the same analysis:python,build-mode: none,security-extendedqueries, onubuntu-latest.secret-scan-trufflehogpre-commit hook (pinned tosecurity-workflowsv0.2.0), skipped on hosted pre-commit.ci which lacks the trufflehog binary.secret-failure-policy: unverifiedexplicitly (fail on verified/live secrets, warn on unverified); fails closed on scanner/infra errors.Checklist