Enable security scanning via NVIDIA/security-workflows suite - #2430
Enable security scanning via NVIDIA/security-workflows suite#2430gmanal wants to merge 3 commits into
Conversation
Call the centrally maintained security suite rather than wiring each scan separately: one pinned reference runs the Pulse secret scan and CodeQL SAST. Every scan in the suite is opt-in, so scanners added upstream later do not switch themselves on here. SAST analyzes python and actions. Both need no toolchain (build-mode none), so they add no build cost and no dependency on the CUDA/conda toolchain. actions matters here because labeler.yml and trigger-breaking-change-alert.yaml run on pull_request_target. c-cpp, java-kotlin, rust and go all need a working build to produce a database and are left out deliberately. Add the secret-scan-trufflehog pre-commit hook as the local advisory layer; the Pulse scan is the server-side enforcement layer.
|
Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually. Contributors can view more details about this message here. |
cjnolet
added
improvement
jameslamb
left a comment
jameslamb
left a comment
There was a problem hiding this comment.
Left some comments for your consideration.
| # strict — fail on any finding (verified or unverified) | ||
| # all — warn only; never fail the job on findings | ||
| secret-failure-policy: unverified | ||
| sast-languages: '["python","actions"]' |
There was a problem hiding this comment.
| sast-languages: '["python","actions"]' | |
| sast-languages: '["actions","python"]' |
Let's alphabetize this, please.
Also, I couldn't find documentation on the available options for this at https://github.com/NVIDIA/security-workflows ... are there more?
This repo has Bash, C++, Go, Java, and Rust code too.
There was a problem hiding this comment.
added java and rust to the scan list.
Go can't be analyzed buildless and would force a build mode Rust rejects; C++ is mostly CUDA, which CodeQL cannot parse at all.
There was a problem hiding this comment.
Go can't be analyzed buildless and would force a build mode Rust rejects
For my own understanding, in case we add this to more repos.... what does this statement mean? Can you provide some links or restate it?
3 participants
Onboards cuVS to NVIDIA's centrally maintained security scanning via
NVIDIA/security-workflows, pinned tov0.3.0.Two layers, no new tooling for this repo to maintain:
secret-scan-trufflehogpre-commit hook, self-installing, pinned by tag like the repo's other hooks.Both scans are enabled explicitly in the new workflow, and every scan in the suite is opt-in — scanners added upstream later won't switch themselves on here.
Changes
.github/workflows/security-suite.yml— on pushes tomain,release/*, and copy-pr-botpull-request/[0-9]+, matchingbuild.yaml/pr.yaml. Uses this repo's permissions style (permissions: {}at workflow level, granted on the job) and thelinux-amd64-cpu4label already used bytelemetry-summarize..pre-commit-config.yaml— add the hook,rev: v0.3.0.SAST scope:
python+actions. Both run under CodeQLbuild-mode: none, so no toolchain and no added build time.actionsearns its place: 9 workflows, two onpull_request_target.Notes for Reviewers
How I tested this
pre-commit runon both changed files — passes, includingzizmor,yamllint,verify-copyright.pre-commit run --all-files secret-scan-trufflehog— clean across the tree. (v0.3.0excludes TruffleHog's Lob detector, which readstest_+ 35 chars as an API key and flagged pytest names as verified secrets elsewhere — hence this pin, not an earlier one.)