From 9a739b9fc7db36f5eee18a2466e2894b42bfcd03 Mon Sep 17 00:00:00 2001 From: gmanal Date: Tue, 11 Aug 2026 19:01:08 +0530 Subject: [PATCH 1/3] Enable security scanning via NVIDIA/security-workflows suite Call the centrally maintained security suite rather than wiring each scan separately: one pinned reference runs the Pulse secret scan and CodeQL SAST. Every scan in the suite is opt-in, so scanners added upstream later do not switch themselves on here. SAST analyzes python and actions. Both need no toolchain (build-mode none), so they add no build cost and no dependency on the CUDA/conda toolchain. actions matters here because labeler.yml and trigger-breaking-change-alert.yaml run on pull_request_target. c-cpp, java-kotlin, rust and go all need a working build to produce a database and are left out deliberately. Add the secret-scan-trufflehog pre-commit hook as the local advisory layer; the Pulse scan is the server-side enforcement layer. --- .github/workflows/security-suite.yml | 46 ++++++++++++++++++++++++++++ .pre-commit-config.yaml | 7 +++++ 2 files changed, 53 insertions(+) create mode 100644 .github/workflows/security-suite.yml diff --git a/.github/workflows/security-suite.yml b/.github/workflows/security-suite.yml new file mode 100644 index 0000000000..494ff46c54 --- /dev/null +++ b/.github/workflows/security-suite.yml @@ -0,0 +1,46 @@ +# SPDX-FileCopyrightText: Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 +# +# CI security scanning via the NVIDIA/security-workflows suite: Pulse secret scan + CodeQL SAST. +# Pulse runs on Linux nv-gha-runners. +# Pinned to security-workflows v0.3.0. + +name: security suite + +on: + push: + branches: + - "main" + - "release/*" + - "pull-request/[0-9]+" + workflow_dispatch: + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +permissions: {} + +jobs: + security-suite: + # Pulse needs nv-gha-runners + Vault/nvcr vars; skip on forks. + if: github.repository == 'NVIDIA/cuvs' + # The caller must grant every permission the reusable workflow declares, including + # scans this repo does not enable — GitHub validates the grant before evaluating + # each scan's condition. + permissions: + actions: read + contents: read + id-token: write # OIDC -> Vault -> nvcr.io image pull + security-events: write # publish redacted SARIF to code scanning + uses: NVIDIA/security-workflows/.github/workflows/security-suite.yml@711025b090f2aa728da576700750b195d1e816dc # v0.3.0 + with: + enable-secret-scan: true + enable-sast-scan: true + secret-runs-on: linux-amd64-cpu4 + # Set the policy explicitly so enforcement can't drift with upstream defaults. + # unverified — fail on verified/live secrets; warn on unverified [default] + # strict — fail on any finding (verified or unverified) + # all — warn only; never fail the job on findings + secret-failure-policy: unverified + sast-languages: '["python","actions"]' diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 0f1d6b7842..a7248aafb4 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -2,6 +2,13 @@ # SPDX-License-Identifier: Apache-2.0 repos: + # Runs first so a leaked credential blocks the commit before any formatter runs. + # Self-installing: pre-commit downloads a pinned, checksum-verified trufflehog into + # the hook environment on first use. CI enforces the same class of finding via Pulse. + - repo: https://github.com/NVIDIA/security-workflows + rev: v0.3.0 + hooks: + - id: secret-scan-trufflehog - repo: https://github.com/pre-commit/pre-commit-hooks rev: v6.0.0 hooks: From 6ce98385996f155f02c7aa40f90d046bd83a59f2 Mon Sep 17 00:00:00 2001 From: gmanal Date: Mon, 17 Aug 2026 15:47:48 +0530 Subject: [PATCH 2/3] ci: address review feedback on security suite --- .github/workflows/pr.yaml | 7 +++++++ .github/workflows/security-suite.yml | 6 +----- .pre-commit-config.yaml | 2 -- 3 files changed, 8 insertions(+), 7 deletions(-) diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml index b4582957ee..2d2ee367aa 100644 --- a/.github/workflows/pr.yaml +++ b/.github/workflows/pr.yaml @@ -100,6 +100,7 @@ jobs: - '!.github/workflows/check-c-abi.yaml' - '!.github/workflows/labeler.yml' - '!.github/workflows/publish-rust.yaml' + - '!.github/workflows/security-suite.yml' - '!.github/workflows/store-c-abi-baseline.yaml' - '!.github/workflows/test.yaml' - '!.github/workflows/trigger-breaking-change-alert.yaml' @@ -132,6 +133,7 @@ jobs: - '!.github/workflows/check-c-abi.yaml' - '!.github/workflows/labeler.yml' - '!.github/workflows/publish-rust.yaml' + - '!.github/workflows/security-suite.yml' - '!.github/workflows/store-c-abi-baseline.yaml' - '!.github/workflows/test.yaml' - '!.github/workflows/trigger-breaking-change-alert.yaml' @@ -177,6 +179,7 @@ jobs: - '!.github/workflows/check-c-abi.yaml' - '!.github/workflows/labeler.yml' - '!.github/workflows/publish-rust.yaml' + - '!.github/workflows/security-suite.yml' - '!.github/workflows/store-c-abi-baseline.yaml' - '!.github/workflows/test.yaml' - '!.github/workflows/trigger-breaking-change-alert.yaml' @@ -229,6 +232,7 @@ jobs: - '!.github/workflows/check-c-abi.yaml' - '!.github/workflows/labeler.yml' - '!.github/workflows/publish-rust.yaml' + - '!.github/workflows/security-suite.yml' - '!.github/workflows/store-c-abi-baseline.yaml' - '!.github/workflows/test.yaml' - '!.github/workflows/trigger-breaking-change-alert.yaml' @@ -278,6 +282,7 @@ jobs: - '!.github/workflows/check-c-abi.yaml' - '!.github/workflows/labeler.yml' - '!.github/workflows/publish-rust.yaml' + - '!.github/workflows/security-suite.yml' - '!.github/workflows/store-c-abi-baseline.yaml' - '!.github/workflows/test.yaml' - '!.github/workflows/trigger-breaking-change-alert.yaml' @@ -332,6 +337,7 @@ jobs: - '!.github/workflows/check-c-abi.yaml' - '!.github/workflows/labeler.yml' - '!.github/workflows/publish-rust.yaml' + - '!.github/workflows/security-suite.yml' - '!.github/workflows/store-c-abi-baseline.yaml' - '!.github/workflows/test.yaml' - '!.github/workflows/trigger-breaking-change-alert.yaml' @@ -381,6 +387,7 @@ jobs: - '!.github/workflows/check-c-abi.yaml' - '!.github/workflows/labeler.yml' - '!.github/workflows/publish-rust.yaml' + - '!.github/workflows/security-suite.yml' - '!.github/workflows/store-c-abi-baseline.yaml' - '!.github/workflows/test.yaml' - '!.github/workflows/trigger-breaking-change-alert.yaml' diff --git a/.github/workflows/security-suite.yml b/.github/workflows/security-suite.yml index 494ff46c54..1267b09b41 100644 --- a/.github/workflows/security-suite.yml +++ b/.github/workflows/security-suite.yml @@ -1,9 +1,5 @@ # SPDX-FileCopyrightText: Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved. # SPDX-License-Identifier: Apache-2.0 -# -# CI security scanning via the NVIDIA/security-workflows suite: Pulse secret scan + CodeQL SAST. -# Pulse runs on Linux nv-gha-runners. -# Pinned to security-workflows v0.3.0. name: security suite @@ -43,4 +39,4 @@ jobs: # strict — fail on any finding (verified or unverified) # all — warn only; never fail the job on findings secret-failure-policy: unverified - sast-languages: '["python","actions"]' + sast-languages: '["actions","python"]' diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index a7248aafb4..7a8c564c94 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -3,8 +3,6 @@ repos: # Runs first so a leaked credential blocks the commit before any formatter runs. - # Self-installing: pre-commit downloads a pinned, checksum-verified trufflehog into - # the hook environment on first use. CI enforces the same class of finding via Pulse. - repo: https://github.com/NVIDIA/security-workflows rev: v0.3.0 hooks: From 7a1b296099e4fba6dac57b29de1ad0a1d2556ee4 Mon Sep 17 00:00:00 2001 From: gmanal Date: Mon, 17 Aug 2026 16:42:32 +0530 Subject: [PATCH 3/3] ci: add Java and Rust to the CodeQL language matrix --- .github/workflows/security-suite.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/security-suite.yml b/.github/workflows/security-suite.yml index 1267b09b41..52517d3c3a 100644 --- a/.github/workflows/security-suite.yml +++ b/.github/workflows/security-suite.yml @@ -39,4 +39,4 @@ jobs: # strict — fail on any finding (verified or unverified) # all — warn only; never fail the job on findings secret-failure-policy: unverified - sast-languages: '["actions","python"]' + sast-languages: '["actions","java-kotlin","python","rust"]'