Enable security scanning via NVIDIA/security-workflows suite - #2430
Enable security scanning via NVIDIA/security-workflows suite#2430gmanal wants to merge 1 commit into
Conversation
Call the centrally maintained security suite rather than wiring each scan separately: one pinned reference runs the Pulse secret scan and CodeQL SAST. Every scan in the suite is opt-in, so scanners added upstream later do not switch themselves on here. SAST analyzes python and actions. Both need no toolchain (build-mode none), so they add no build cost and no dependency on the CUDA/conda toolchain. actions matters here because labeler.yml and trigger-breaking-change-alert.yaml run on pull_request_target. c-cpp, java-kotlin, rust and go all need a working build to produce a database and are left out deliberately. Add the secret-scan-trufflehog pre-commit hook as the local advisory layer; the Pulse scan is the server-side enforcement layer.
|
Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually. Contributors can view more details about this message here. |
cjnolet
added
improvement
jameslamb
left a comment
jameslamb
left a comment
There was a problem hiding this comment.
Left some comments for your consideration.
| # strict — fail on any finding (verified or unverified) | ||
| # all — warn only; never fail the job on findings | ||
| secret-failure-policy: unverified | ||
| sast-languages: '["python","actions"]' |
There was a problem hiding this comment.
| sast-languages: '["python","actions"]' | |
| sast-languages: '["actions","python"]' |
Let's alphabetize this, please.
Also, I couldn't find documentation on the available options for this at https://github.com/NVIDIA/security-workflows ... are there more?
This repo has Bash, C++, Go, Java, and Rust code too.
| # Runs first so a leaked credential blocks the commit before any formatter runs. | ||
| # Self-installing: pre-commit downloads a pinned, checksum-verified trufflehog into | ||
| # the hook environment on first use. CI enforces the same class of finding via Pulse. | ||
| - repo: https://github.com/NVIDIA/security-workflows |
There was a problem hiding this comment.
| # Runs first so a leaked credential blocks the commit before any formatter runs. | |
| # Self-installing: pre-commit downloads a pinned, checksum-verified trufflehog into | |
| # the hook environment on first use. CI enforces the same class of finding via Pulse. | |
| - repo: https://github.com/NVIDIA/security-workflows | |
| # Runs first so a leaked credential blocks the commit before any formatter runs. | |
| - repo: https://github.com/NVIDIA/security-workflows |
Let's remove this comment that explains how pre-commit works, please.
There was a problem hiding this comment.
Please add this file to all the changed-files lists in https://github.com/NVIDIA/cuvs/blob/main/.github/workflows/pr.yaml (preserve alphabetical order).
We shouldn't need to trigger cuVS's expensive GPU-using CI on PRs that only change this file.
| # Pulse runs on Linux nv-gha-runners. | ||
| # Pinned to security-workflows v0.3.0. | ||
|
|
There was a problem hiding this comment.
| # Pulse runs on Linux nv-gha-runners. | |
| # Pinned to security-workflows v0.3.0. |
Let's please remove these comments that don't add information (they are obvious from the code) and are likely to become out of date as this configuration changes over time.
3 participants
Onboards cuVS to NVIDIA's centrally maintained security scanning via
NVIDIA/security-workflows, pinned tov0.3.0.Two layers, no new tooling for this repo to maintain:
secret-scan-trufflehogpre-commit hook, self-installing, pinned by tag like the repo's other hooks.Both scans are enabled explicitly in the new workflow, and every scan in the suite is opt-in — scanners added upstream later won't switch themselves on here.
Changes
.github/workflows/security-suite.yml— on pushes tomain,release/*, and copy-pr-botpull-request/[0-9]+, matchingbuild.yaml/pr.yaml. Uses this repo's permissions style (permissions: {}at workflow level, granted on the job) and thelinux-amd64-cpu4label already used bytelemetry-summarize..pre-commit-config.yaml— add the hook,rev: v0.3.0.SAST scope:
python+actions. Both run under CodeQLbuild-mode: none, so no toolchain and no added build time.actionsearns its place: 9 workflows, two onpull_request_target.Notes for Reviewers
How I tested this
pre-commit runon both changed files — passes, includingzizmor,yamllint,verify-copyright.pre-commit run --all-files secret-scan-trufflehog— clean across the tree. (v0.3.0excludes TruffleHog's Lob detector, which readstest_+ 35 chars as an API key and flagged pytest names as verified secrets elsewhere — hence this pin, not an earlier one.)