feat(security): onboard pre-commit and Pulse secret scanning#2405
feat(security): onboard pre-commit and Pulse secret scanning#2405gmanal wants to merge 6 commits into
Conversation
|
5d5f33f to
2df9477
Compare
Onboard NVIDIA/security-workflows secret scanning: - .github/workflows/secret-scan-pulse.yml: call the Pulse reusable workflow (pinned by commit SHA) on pushes to main, ctk-next, and copy-pr-bot pull-request branches; runs on nv-cpu-general with the default unverified failure_policy. - .pre-commit-config.yaml: add the secret-scan-trufflehog local hook (pinned to security-workflows v0.1.0), skipped on pre-commit.ci which lacks the trufflehog binary. - CONTRIBUTING.md: document local secret-scan setup.
2df9477 to
c5c2cf8
Compare
| uses: NVIDIA/security-workflows/.github/workflows/secret-scan-pulse.yml@69032f641c3c34e0c0b46f636b54ed2b101b7aa4 | ||
| with: | ||
| runs-on: linux-amd64-cpu4 | ||
| # Set failure_policy explicitly so enforcement can't drift with upstream defaults. |
There was a problem hiding this comment.
Is the Linux-only execution context intentional? The called workflow relies on POSIX shell syntax, docker, and python3, while the local pre-commit hook is also Bash-only and documents no Windows installation path. If Windows developers are expected to use this hook, please add a supported Windows implementation/instructions; otherwise, please document that this control is Linux/macOS-only.
There was a problem hiding this comment.
- Local pre-commit hook: now cross-platform (Linux/macOS/Windows via Git Bash) as of v0.2.0.
- CI reusable workflow (Pulse): intentionally Linux. It runs the NVIDIA-licensed Pulse scanner as a Docker container on nv-gha-runners with OIDC→Vault, so it's a server-side control on Linux CI runners — OS-independent from the contributor's side (a Windows dev's PR is still scanned in CI). I'll add a note that the CI control runs on Linux runners by design, while the developer hook is cross-platform.
| permissions: | ||
| contents: read | ||
| id-token: write # OIDC -> Vault -> nvcr.io image pull | ||
| security-events: write # publish redacted SARIF to code scanning |
There was a problem hiding this comment.
NVIDIA/cuda-python is public. GitHub documents actions: read as required by upload-sarif only for private repositories; this workflow otherwise needs contents: read, id-token: write, and security-events: write. Could we drop actions: read here to keep the caller token at the minimum scope?
There was a problem hiding this comment.
Correction to my earlier "done" — I reverted this; actions: read is required here after all, though not for the private-repo reason.
The mechanism is reusable-workflow permission validation, not an intersection. The called workflow (NVIDIA/security-workflows/.github/workflows/secret-scan-pulse.yml, SHA-pinned) declares actions: read in its own permissions: block, and GitHub requires the caller to grant at least every permission the reusable workflow declares. With actions: read removed, the caller offered actions: none and the run failed at load time:
Error calling workflow '…/secret-scan-pulse.yml@69032f64…'. The workflow is requesting 'actions: read', but is only allowed 'actions: none'.
Dropping it from the caller would only be valid if we also dropped it from the reusable definition — but that workflow is generic and also consumed by private repos, where upload-sarif genuinely needs actions: read. So the reusable correctly keeps declaring it, and public callers grant it (harmless on public). Restored in 94851cd.
… CI and Windows (Git Bash)
ff352f5 to
ff758ac
Compare
The pinned NVIDIA/security-workflows secret-scan-pulse.yml declares
actions: read in its own permissions block. A reusable workflow cannot
request more than the caller grants, so dropping actions: read from this
caller made the run fail at load time ("requesting actions: read, but is
only allowed actions: none"). Restore it.
|
Blocked by #2327 so that Windows developers can install |
3 participants
Description
Onboard NVIDIA secret scanning to cuda-python using the centrally maintained NVIDIA/security-workflows surfaces. Two complementary controls:
secret-scan-trufflehogpre-commit hook — catches credentials before commit.Changes
.github/workflows/secret-scan-pulse.ymlcalling the centralized Pulse reusable workflow, onmain,ctk-next, and copy-pr-botpull-request/*branches; runs onnv-cpu-general(onboarded for this repo in the enterprise runner config).secret-scan-trufflehogpre-commit hook (pinned tosecurity-workflowsv0.1.0), skipped on hosted pre-commit.ci which lacks the trufflehog binary.failure_policy: unverifiedexplicitly (fail on verified/live secrets, warn on unverified); fails closed on scanner/infra errors.revto release tagv0.1.0, workflowuses:to a reviewed commit SHA.Checklist