From c79213c545de69a20edcbe679d82ab58d126c962 Mon Sep 17 00:00:00 2001 From: gmanal Date: Mon, 10 Aug 2026 14:33:22 +0530 Subject: [PATCH] feat(security): onboard security-suite (secret + CodeQL) scanning. Call the centrally maintained NVIDIA/security-workflows security suite rather than wiring each scan separately: one pinned reference runs the Pulse secret scan and CodeQL SAST, both explicitly enabled. Replace .github/workflows/codeql.yml with the suite's SAST scan. Both publish code scanning results under the category /language:python, so keeping the local workflow would put two analyses on every commit that overwrite each other's alerts. The suite performs the same analysis: python, build-mode none, security-extended queries, on ubuntu-latest. --- .github/workflows/codeql.yml | 46 --------------------------- .github/workflows/security-suite.yml | 47 ++++++++++++++++++++++++++++ .pre-commit-config.yaml | 10 +++++- CONTRIBUTING.md | 5 +++ 4 files changed, 61 insertions(+), 47 deletions(-) delete mode 100644 .github/workflows/codeql.yml create mode 100644 .github/workflows/security-suite.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml deleted file mode 100644 index 87bcd8e58d5..00000000000 --- a/.github/workflows/codeql.yml +++ /dev/null @@ -1,46 +0,0 @@ -# SPDX-FileCopyrightText: Copyright (c) 2024-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -# -# SPDX-License-Identifier: Apache-2.0 - -name: "Static Analysis: CodeQL Scan" - -on: - push: - branches: - - "pull-request/[0-9]+" - - "ctk-next" - - "main" -concurrency: - group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }} - cancel-in-progress: true - -jobs: - analyze: - name: Analyze (${{ matrix.language }}) - runs-on: ubuntu-latest - permissions: - actions: read - contents: read - security-events: write - - strategy: - fail-fast: false - matrix: - include: - - language: python - build-mode: none - steps: - - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - - name: Initialize CodeQL - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 - with: - languages: ${{ matrix.language }} - build-mode: ${{ matrix.build-mode }} - queries: security-extended - - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 - with: - category: "/language:${{matrix.language}}" diff --git a/.github/workflows/security-suite.yml b/.github/workflows/security-suite.yml new file mode 100644 index 00000000000..0902db6119a --- /dev/null +++ b/.github/workflows/security-suite.yml @@ -0,0 +1,47 @@ +# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# +# SPDX-License-Identifier: Apache-2.0 +# +# CI security scanning via the NVIDIA/security-workflows suite: Pulse secret scan + CodeQL SAST. +# Pulse runs on Linux nv-gha-runners (Docker image + OIDC/Vault) — Linux-only by design. +# The local secret-scan-trufflehog pre-commit hook is cross-platform (Linux/macOS/Windows). +# Pinned to a reviewed commit SHA. + +name: Security Suite (Pulse + CodeQL) + +on: + push: + branches: + - main + - ctk-next + - "pull-request/[0-9]+" + workflow_dispatch: + +concurrency: + group: ${{ github.workflow }}-on-${{ github.event_name }}-from-${{ github.ref_name }} + cancel-in-progress: true + +# Caller must grant every permission the reusable workflow declares, including scans it disables. +permissions: + contents: read + id-token: write # OIDC -> Vault -> nvcr.io image pull + security-events: write # publish redacted SARIF to code scanning + actions: read + +jobs: + security-suite: + name: Security Suite + # Pulse needs nv-gha-runners + Vault/nvcr vars; skip on forks. + if: github.repository == 'NVIDIA/cuda-python' + uses: NVIDIA/security-workflows/.github/workflows/security-suite.yml@711025b090f2aa728da576700750b195d1e816dc # v0.3.0 + with: + enable-secret-scan: true + enable-sast-scan: true + secret-runs-on: linux-amd64-cpu4 + # Set failure_policy explicitly so enforcement can't drift with upstream defaults. + # unverified — fail on verified/live secrets (183); warn on unverified (185) [default] + # strict — fail on any finding (verified or unverified) + # all — warn only; never fail the job on findings + secret-failure-policy: unverified + # Same analysis the retired codeql.yml performed: python, build-mode none, security-extended. + sast-languages: '["python"]' diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 30faa009fc2..62220467b71 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -9,12 +9,20 @@ ci: autoupdate_branch: '' autoupdate_commit_msg: '[pre-commit.ci] pre-commit autoupdate' autoupdate_schedule: quarterly - skip: [lychee, check-precommit-installed] + skip: [lychee, check-precommit-installed, secret-scan-trufflehog] submodules: false # Please update the rev: SHAs below with this command: # pre-commit autoupdate --freeze repos: + # Runs first so a leaked credential blocks the commit before any formatter runs. + # Self-installing: the hook downloads a pinned, checksum-verified trufflehog on + # first use (no manual install). Skipped on pre-commit.ci; Pulse CI enforces server-side. + - repo: https://github.com/NVIDIA/security-workflows + rev: 711025b090f2aa728da576700750b195d1e816dc # frozen: v0.3.0 + hooks: + - id: secret-scan-trufflehog + - repo: https://github.com/astral-sh/ruff-pre-commit rev: c60c980e561ed3e73101667fe8365c609d19a438 # frozen: v0.15.9 hooks: diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 2a477edddeb..7474ac4d840 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -179,6 +179,11 @@ commit` workflow. To resolve this, you can either: 2. Skip it by setting the environment variable `SKIP` to `lychee`. This would be `$env:SKIP = "lychee"` in PowerShell or `set SKIP=lychee` in cmd. +## Secret Scanning + +The `secret-scan-trufflehog` pre-commit hook scans staged files and installs TruffleHog into its own environment on first run, on Linux, macOS, and Windows. If it flags a secret, remove it before committing, or contact a maintainer if it's a false positive. Secrets are also scanned server-side in CI. + + ## Signing Your Work Contributions to files licensed under Apache 2.0 must be certified under the