From 39d23b45b715f9ad7207561e7de82e4b4d5ac70f Mon Sep 17 00:00:00 2001 From: Laura Promberger Date: Tue, 21 Jul 2026 18:43:27 +0200 Subject: [PATCH 1/8] add security scanners --- .github/dependabot.yml | 14 +++++++ .github/workflows/bandit.yml | 34 ++++++++++++++++ .github/workflows/codeql.yml | 52 ++++++++++++++++++++++++ .github/workflows/gitleaks_pr.yml | 24 +++++++++++ .github/workflows/gitleaks_scheduled.yml | 32 +++++++++++++++ .github/workflows/zizmor.yml | 30 ++++++++++++++ 6 files changed, 186 insertions(+) create mode 100644 .github/dependabot.yml create mode 100644 .github/workflows/bandit.yml create mode 100644 .github/workflows/codeql.yml create mode 100644 .github/workflows/gitleaks_pr.yml create mode 100644 .github/workflows/gitleaks_scheduled.yml create mode 100644 .github/workflows/zizmor.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 000000000..0fc6c1ef0 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,14 @@ +version: 2 +updates: + + # Check for updates to GitHub Actions + - package-ecosystem: "github-actions" + directories: + - "/" + - "/.github/actions/*" + schedule: + interval: "weekly" + groups: + github-actions: + patterns: + - "*" \ No newline at end of file diff --git a/.github/workflows/bandit.yml b/.github/workflows/bandit.yml new file mode 100644 index 000000000..c1fea84df --- /dev/null +++ b/.github/workflows/bandit.yml @@ -0,0 +1,34 @@ +# Copyright Advanced Micro Devices, Inc. +# SPDX-License-Identifier: MIT +# +# Post-merge bandit scan: runs after every push to main (typically the +# squash/rebase/merge of a PR) and pushes SARIF findings to the +# repository's code-scanning Security tab. Complements the PR-only +# bandit job in `ci.yml`, which scans only changed Python files and +# uploads an HTML artifact for in-review browsing. +name: Bandit + +on: + push: + branches: [main, develop] + # Allow re-running the post-merge scan on demand, e.g. after tweaking + # `bandit.yaml` or rotating the bandit version pin, so the Security + # tab can be refreshed without an unrelated commit. + workflow_dispatch: + +permissions: + contents: read + +jobs: + bandit: + uses: ROCm/TheRock/.github/workflows/bandit.yml + with: + scan_mode: all + report_formats: sarif + permissions: + contents: read + # Required so the reusable workflow can call + # github/codeql-action/upload-sarif and have the findings + # appear under Security -> Code scanning, filterable by + # `Tool: Bandit` separately from any other scanner. + security-events: write \ No newline at end of file diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 000000000..ab61fc574 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,52 @@ +# Copyright Advanced Micro Devices, Inc. +# SPDX-License-Identifier: MIT +# +name: CodeQL + +on: + push: + branches: [main, develop] + paths: + - '**/*.py' + - '.github/**' + pull_request: + branches: [main, develop] + paths: + - '**/*.py' + - '.github/**' + workflow_dispatch: + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +premissions: + contents: read + +jobs: + analyze: + if: github.event_name != 'pull_request' || github.event.pull_request.draft == false + name: Analyze (${{ matrix.language }}) + runs-on: ubuntu-24.04 + timeout-minutes: 30 + permissions: + contents: read + security-events: write + strategy: + fail-fast: false + matrix: + language: [python, actions] + steps: + - name: Checkout repository + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + + - name: Initialize CodeQL + uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 + with: + languages: ${{ matrix.language }} + queries: security-extended + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 + with: + category: "/language:${{ matrix.language }}" \ No newline at end of file diff --git a/.github/workflows/gitleaks_pr.yml b/.github/workflows/gitleaks_pr.yml new file mode 100644 index 000000000..646aa98c8 --- /dev/null +++ b/.github/workflows/gitleaks_pr.yml @@ -0,0 +1,24 @@ +# Copyright Advanced Micro Devices, Inc. +# SPDX-License-Identifier: MIT + +name: Gitleaks for PRs + +on: + pull_request: + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +permissions: + contents: read + +jobs: + # Scan commits introduced by this PR (`scan_mode: changed`, the + # reusable workflow's default). CSV report is uploaded as a build + # artifact and printed to the job summary so reviewers can browse + # findings directly from the PR's Checks tab. + gitleaks: + uses: ./.github/workflows/gitleaks.yml + with: + report_formats: csv \ No newline at end of file diff --git a/.github/workflows/gitleaks_scheduled.yml b/.github/workflows/gitleaks_scheduled.yml new file mode 100644 index 000000000..e8cc41ea1 --- /dev/null +++ b/.github/workflows/gitleaks_scheduled.yml @@ -0,0 +1,32 @@ +# Copyright Advanced Micro Devices, Inc. +# SPDX-License-Identifier: MIT +# +# Weekly gitleaks scan: runs on a fixed cadence and pushes +# SARIF findings to the repository's code-scanning Security tab. +name: Gitleaks (Scheduled) + +on: + # Run every Saturday at 10:00 UTC. + schedule: + - cron: "0 10 * * 6" + # Allow re-running the weekly scan on demand, e.g. after + # tweaking `gitleaks.toml` or rotating the gitleaks version pin, so + # the Security tab can be refreshed without an unrelated commit. + workflow_dispatch: + +permissions: + contents: read + +jobs: + gitleaks: + uses: ROCm/TheRock/.github/workflows/gitleaks.yml + with: + scan_mode: all + report_formats: sarif + permissions: + contents: read + # Required so the reusable workflow can call + # github/codeql-action/upload-sarif and have the findings + # appear under Security -> Code scanning, filterable by + # `Tool: gitleaks` separately from any other scanner. + security-events: write \ No newline at end of file diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 000000000..7beef73f3 --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,30 @@ +# Copyright Advanced Micro Devices, Inc. +# SPDX-License-Identifier: MIT + +name: Zizmor + +on: + pull_request: + push: + branches: [main, develop] + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +premissions: + contents: read + +jobs: + zizmor: + uses: ROCm/rocm-tests/.github/workflows/zizmor.yml + with: + scan_mode: all + report_formats: sarif + permissions: + contents: read + # Required so the reusable workflow can call + # github/codeql-action/upload-sarif and have the findings + # appear under Security -> Code scanning, filterable by + # `Tool: zizmor` separately from any other scanner. + security-events: write \ No newline at end of file From 31d31e37f6e450b17316e272217a362987d97e30 Mon Sep 17 00:00:00 2001 From: Laura Promberger Date: Tue, 21 Jul 2026 18:53:59 +0200 Subject: [PATCH 2/8] fix typos + proper workflow calls --- .github/dependabot.yml | 2 +- .github/workflows/bandit.yml | 4 ++-- .github/workflows/codeql.yml | 4 ++-- .github/workflows/gitleaks_pr.yml | 4 ++-- .github/workflows/gitleaks_scheduled.yml | 4 ++-- .github/workflows/zizmor.yml | 6 +++--- 6 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 0fc6c1ef0..7996690bf 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -11,4 +11,4 @@ updates: groups: github-actions: patterns: - - "*" \ No newline at end of file + - "*" diff --git a/.github/workflows/bandit.yml b/.github/workflows/bandit.yml index c1fea84df..a2086455b 100644 --- a/.github/workflows/bandit.yml +++ b/.github/workflows/bandit.yml @@ -21,7 +21,7 @@ permissions: jobs: bandit: - uses: ROCm/TheRock/.github/workflows/bandit.yml + uses: ROCm/TheRock/.github/workflows/bandit.yml@main with: scan_mode: all report_formats: sarif @@ -31,4 +31,4 @@ jobs: # github/codeql-action/upload-sarif and have the findings # appear under Security -> Code scanning, filterable by # `Tool: Bandit` separately from any other scanner. - security-events: write \ No newline at end of file + security-events: write diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index ab61fc574..03f6d95d4 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -20,7 +20,7 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true -premissions: +permissions: contents: read jobs: @@ -49,4 +49,4 @@ jobs: - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 with: - category: "/language:${{ matrix.language }}" \ No newline at end of file + category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/gitleaks_pr.yml b/.github/workflows/gitleaks_pr.yml index 646aa98c8..ba2b4915f 100644 --- a/.github/workflows/gitleaks_pr.yml +++ b/.github/workflows/gitleaks_pr.yml @@ -19,6 +19,6 @@ jobs: # artifact and printed to the job summary so reviewers can browse # findings directly from the PR's Checks tab. gitleaks: - uses: ./.github/workflows/gitleaks.yml + uses: ROCm/TheRock/.github/workflows/gitleaks.yml@main with: - report_formats: csv \ No newline at end of file + report_formats: csv diff --git a/.github/workflows/gitleaks_scheduled.yml b/.github/workflows/gitleaks_scheduled.yml index e8cc41ea1..e9a475d36 100644 --- a/.github/workflows/gitleaks_scheduled.yml +++ b/.github/workflows/gitleaks_scheduled.yml @@ -19,7 +19,7 @@ permissions: jobs: gitleaks: - uses: ROCm/TheRock/.github/workflows/gitleaks.yml + uses: ROCm/TheRock/.github/workflows/gitleaks.yml@main with: scan_mode: all report_formats: sarif @@ -29,4 +29,4 @@ jobs: # github/codeql-action/upload-sarif and have the findings # appear under Security -> Code scanning, filterable by # `Tool: gitleaks` separately from any other scanner. - security-events: write \ No newline at end of file + security-events: write diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 7beef73f3..a1b1d0406 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -12,12 +12,12 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true -premissions: +permissions: contents: read jobs: zizmor: - uses: ROCm/rocm-tests/.github/workflows/zizmor.yml + uses: ROCm/rocm-tests/.github/workflows/zizmor.yml@main with: scan_mode: all report_formats: sarif @@ -27,4 +27,4 @@ jobs: # github/codeql-action/upload-sarif and have the findings # appear under Security -> Code scanning, filterable by # `Tool: zizmor` separately from any other scanner. - security-events: write \ No newline at end of file + security-events: write From 3af76af849e19450dee8a6ca4eeba86781fde99d Mon Sep 17 00:00:00 2001 From: Laura Promberger Date: Wed, 22 Jul 2026 09:56:36 +0200 Subject: [PATCH 3/8] add missing compute_pr_fetch_depth --- .../actions/compute_pr_fetch_depth/action.yml | 29 +++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 .github/actions/compute_pr_fetch_depth/action.yml diff --git a/.github/actions/compute_pr_fetch_depth/action.yml b/.github/actions/compute_pr_fetch_depth/action.yml new file mode 100644 index 000000000..1d697e149 --- /dev/null +++ b/.github/actions/compute_pr_fetch_depth/action.yml @@ -0,0 +1,29 @@ +# Copyright Advanced Micro Devices, Inc. +# SPDX-License-Identifier: MIT + +name: "Compute PR-aware fetch-depth" + +description: >- + Returns the smallest `actions/checkout` fetch-depth that covers all + commits this workflow needs to walk. + + * pull_request events: `commits + 1` (PR commits + merge-base). + * any other event (push, schedule, workflow_dispatch, ...): `0` + (full history). Use this when downstream tooling walks commit + history + +outputs: + value: + description: >- + String value to pass to actions/checkout fetch-depth. Already + coerced to a string so it composes cleanly with checkout's + input parser. + value: ${{ steps.compute.outputs.value }} + +runs: + using: "composite" + steps: + - name: Compute fetch-depth + id: compute + shell: bash + run: python build_tools/github_actions/compute_pr_depth.py From 9189516a4e86abe9debc3901ca61e97852bdd6cd Mon Sep 17 00:00:00 2001 From: Laura Promberger Date: Wed, 22 Jul 2026 11:11:28 +0200 Subject: [PATCH 4/8] fix scanners? --- .../actions/compute_pr_fetch_depth/action.yml | 29 ---- .github/workflows/_security_scan.yml | 162 ++++++++++++++++++ .github/workflows/bandit.yml | 16 +- .github/workflows/gitleaks_pr.yml | 14 +- .github/workflows/gitleaks_scheduled.yml | 8 +- .github/workflows/zizmor.yml | 8 +- 6 files changed, 192 insertions(+), 45 deletions(-) delete mode 100644 .github/actions/compute_pr_fetch_depth/action.yml create mode 100644 .github/workflows/_security_scan.yml diff --git a/.github/actions/compute_pr_fetch_depth/action.yml b/.github/actions/compute_pr_fetch_depth/action.yml deleted file mode 100644 index 1d697e149..000000000 --- a/.github/actions/compute_pr_fetch_depth/action.yml +++ /dev/null @@ -1,29 +0,0 @@ -# Copyright Advanced Micro Devices, Inc. -# SPDX-License-Identifier: MIT - -name: "Compute PR-aware fetch-depth" - -description: >- - Returns the smallest `actions/checkout` fetch-depth that covers all - commits this workflow needs to walk. - - * pull_request events: `commits + 1` (PR commits + merge-base). - * any other event (push, schedule, workflow_dispatch, ...): `0` - (full history). Use this when downstream tooling walks commit - history - -outputs: - value: - description: >- - String value to pass to actions/checkout fetch-depth. Already - coerced to a string so it composes cleanly with checkout's - input parser. - value: ${{ steps.compute.outputs.value }} - -runs: - using: "composite" - steps: - - name: Compute fetch-depth - id: compute - shell: bash - run: python build_tools/github_actions/compute_pr_depth.py diff --git a/.github/workflows/_security_scan.yml b/.github/workflows/_security_scan.yml new file mode 100644 index 000000000..0f6e0ffe5 --- /dev/null +++ b/.github/workflows/_security_scan.yml @@ -0,0 +1,162 @@ +# Copyright Advanced Micro Devices, Inc. +# SPDX-License-Identifier: MIT +# +# Shared engine for the security scanners (gitleaks / bandit / zizmor). +# +# The scanner scripts live in external tool repos (ROCm/TheRock, +# ROCm/rocm-tests). Each script imports `github_actions_api` from its own +# repo's build_tools/ and resolves a config file (gitleaks.toml / +# bandit.yaml / zizmor.yml) against the current working directory. None of +# that exists in this repo, so a plain `uses:` call to the upstream +# reusable workflow -- whose `run:` steps and `./.github/actions/...` refs +# resolve against THIS checkout -- fails on the missing files. +# +# Instead we check the tool repo out ourselves (into _tool), copy its +# config into the scan root, and run its script with the working directory +# set to the scan target. This workflow is fully self-contained (no +# caller-relative refs), so it can be lifted into a common ROCm security +# repo unchanged and called via `uses: ROCm//...@main`. +name: _security_scan + +on: + workflow_call: + inputs: + tool: + description: "Scanner name; drives the SARIF category and artifact name." + required: true + type: string + tool_repo: + description: "owner/repo holding the scanner script (checked out to _tool)." + required: true + type: string + tool_ref: + description: "Ref of tool_repo to check out." + required: false + type: string + default: main + script_path: + description: "Path to the scanner script inside the tool checkout." + required: true + type: string + config_path: + description: >- + Config file inside the tool checkout, copied to the scan root so + the scanner script can resolve it relative to its working + directory. + required: true + type: string + scan_mode: + description: "'changed' (default) or 'all'. See the scanner scripts." + required: false + type: string + default: changed + report_formats: + description: "Comma-separated report formats. See the scanner scripts." + required: false + type: string + default: sarif + scan_path: + description: "Path (relative to the scan root) to scan." + required: false + type: string + default: "." + severity_threshold: + description: "Minimum severity that fails the job (bandit / zizmor only)." + required: false + type: string + default: high + persona: + description: "Zizmor audit persona (zizmor only)." + required: false + type: string + default: regular + +permissions: + contents: read + +jobs: + scan: + name: ${{ inputs.tool }} scan + runs-on: ubuntu-24.04 + timeout-minutes: 30 + steps: + # PR-aware checkout depth: PR commits + merge base lets the scanner + # walk base..head; full history (0) for everything else. GHA + # expressions can't do arithmetic, so compute it in bash. + - name: Compute fetch-depth + id: depth + env: + EVENT_NAME: ${{ github.event_name }} + PR_COMMITS: ${{ github.event.pull_request.commits }} + run: | + if [ "$EVENT_NAME" = "pull_request" ]; then + echo "value=$((PR_COMMITS + 1))" >> "$GITHUB_OUTPUT" + else + echo "value=0" >> "$GITHUB_OUTPUT" + fi + + # Scan target = the calling repo. In a reusable workflow an + # `actions/checkout` with no `repository:` defaults to + # github.repository, which is the caller. + - name: Checkout scan target + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + fetch-depth: ${{ steps.depth.outputs.value }} + ref: ${{ github.event.pull_request.head.sha || github.sha }} + persist-credentials: false + + - name: Checkout scanner tool + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + repository: ${{ inputs.tool_repo }} + ref: ${{ inputs.tool_ref }} + path: _tool + fetch-depth: 1 + persist-credentials: false + + # The scanner resolves its config against the working directory, so + # stage the tool repo's config at the scan root. It stays untracked; + # history-based scans key off commits, not the working tree. + - name: Stage scanner config + run: cp "_tool/${{ inputs.config_path }}" ./ + + - name: Set up Python + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + with: + python-version: "3.12" + + # Each scanner reads only its own PREFIX_* vars, so exporting all + # three prefixes from the same inputs is a harmless no-op for the + # ones that don't apply. + - name: Run ${{ inputs.tool }} + id: scan + env: + GITLEAKS_SCAN_MODE: ${{ inputs.scan_mode }} + GITLEAKS_REPORT_FORMATS: ${{ inputs.report_formats }} + GITLEAKS_SOURCE_DIR: ${{ inputs.scan_path }} + BANDIT_SCAN_MODE: ${{ inputs.scan_mode }} + BANDIT_REPORT_FORMATS: ${{ inputs.report_formats }} + BANDIT_SOURCE_DIR: ${{ inputs.scan_path }} + BANDIT_SEVERITY_THRESHOLD: ${{ inputs.severity_threshold }} + ZIZMOR_SCAN_MODE: ${{ inputs.scan_mode }} + ZIZMOR_REPORT_FORMATS: ${{ inputs.report_formats }} + ZIZMOR_SOURCE_DIR: ${{ inputs.scan_path }} + ZIZMOR_SEVERITY_THRESHOLD: ${{ inputs.severity_threshold }} + ZIZMOR_PERSONA: ${{ inputs.persona }} + GH_TOKEN: ${{ github.token }} + run: python "_tool/${{ inputs.script_path }}" + + - name: Upload SARIF report to code scanning + if: always() && steps.scan.outputs.sarif_path != '' + uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 + with: + sarif_file: ${{ steps.scan.outputs.sarif_path }} + category: ${{ inputs.tool }} + + - name: Upload non-SARIF reports + if: always() && steps.scan.outputs.non_sarif_paths != '' + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: ${{ inputs.tool }}-report + path: ${{ steps.scan.outputs.non_sarif_paths }} + if-no-files-found: ignore diff --git a/.github/workflows/bandit.yml b/.github/workflows/bandit.yml index a2086455b..78c1548f3 100644 --- a/.github/workflows/bandit.yml +++ b/.github/workflows/bandit.yml @@ -1,11 +1,9 @@ # Copyright Advanced Micro Devices, Inc. # SPDX-License-Identifier: MIT # -# Post-merge bandit scan: runs after every push to main (typically the -# squash/rebase/merge of a PR) and pushes SARIF findings to the -# repository's code-scanning Security tab. Complements the PR-only -# bandit job in `ci.yml`, which scans only changed Python files and -# uploads an HTML artifact for in-review browsing. +# Post-merge bandit scan: runs after every push to main/develop (typically +# the squash/rebase/merge of a PR) and pushes SARIF findings to the +# repository's code-scanning Security tab. name: Bandit on: @@ -21,13 +19,17 @@ permissions: jobs: bandit: - uses: ROCm/TheRock/.github/workflows/bandit.yml@main + uses: ./.github/workflows/_security_scan.yml with: + tool: bandit + tool_repo: ROCm/rocm-tests + script_path: scan_tools/github_actions/bandit.py + config_path: bandit.yaml scan_mode: all report_formats: sarif permissions: contents: read - # Required so the reusable workflow can call + # Required so the SARIF upload step can call # github/codeql-action/upload-sarif and have the findings # appear under Security -> Code scanning, filterable by # `Tool: Bandit` separately from any other scanner. diff --git a/.github/workflows/gitleaks_pr.yml b/.github/workflows/gitleaks_pr.yml index ba2b4915f..7544697e8 100644 --- a/.github/workflows/gitleaks_pr.yml +++ b/.github/workflows/gitleaks_pr.yml @@ -14,11 +14,15 @@ permissions: contents: read jobs: - # Scan commits introduced by this PR (`scan_mode: changed`, the - # reusable workflow's default). CSV report is uploaded as a build - # artifact and printed to the job summary so reviewers can browse - # findings directly from the PR's Checks tab. + # Scan commits introduced by this PR (`scan_mode: changed`). CSV report + # is uploaded as a build artifact and printed to the job summary so + # reviewers can browse findings directly from the PR's Checks tab. gitleaks: - uses: ROCm/TheRock/.github/workflows/gitleaks.yml@main + uses: ./.github/workflows/_security_scan.yml with: + tool: gitleaks + tool_repo: ROCm/TheRock + script_path: build_tools/scan_tools/github_actions/gitleaks.py + config_path: gitleaks.toml + scan_mode: changed report_formats: csv diff --git a/.github/workflows/gitleaks_scheduled.yml b/.github/workflows/gitleaks_scheduled.yml index e9a475d36..ebfd8bced 100644 --- a/.github/workflows/gitleaks_scheduled.yml +++ b/.github/workflows/gitleaks_scheduled.yml @@ -19,13 +19,17 @@ permissions: jobs: gitleaks: - uses: ROCm/TheRock/.github/workflows/gitleaks.yml@main + uses: ./.github/workflows/_security_scan.yml with: + tool: gitleaks + tool_repo: ROCm/TheRock + script_path: build_tools/scan_tools/github_actions/gitleaks.py + config_path: gitleaks.toml scan_mode: all report_formats: sarif permissions: contents: read - # Required so the reusable workflow can call + # Required so the SARIF upload step can call # github/codeql-action/upload-sarif and have the findings # appear under Security -> Code scanning, filterable by # `Tool: gitleaks` separately from any other scanner. diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index a1b1d0406..ec7557a70 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -17,13 +17,17 @@ permissions: jobs: zizmor: - uses: ROCm/rocm-tests/.github/workflows/zizmor.yml@main + uses: ./.github/workflows/_security_scan.yml with: + tool: zizmor + tool_repo: ROCm/rocm-tests + script_path: scan_tools/github_actions/zizmor.py + config_path: zizmor.yml scan_mode: all report_formats: sarif permissions: contents: read - # Required so the reusable workflow can call + # Required so the SARIF upload step can call # github/codeql-action/upload-sarif and have the findings # appear under Security -> Code scanning, filterable by # `Tool: zizmor` separately from any other scanner. From 8d2a212d2fe0ec2b94d6303ab8131484c5768838 Mon Sep 17 00:00:00 2001 From: Laura Promberger Date: Wed, 22 Jul 2026 11:57:15 +0200 Subject: [PATCH 5/8] fix zizmor complaints --- .github/workflows/_security_scan.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/_security_scan.yml b/.github/workflows/_security_scan.yml index 0f6e0ffe5..6abce9044 100644 --- a/.github/workflows/_security_scan.yml +++ b/.github/workflows/_security_scan.yml @@ -118,7 +118,9 @@ jobs: # stage the tool repo's config at the scan root. It stays untracked; # history-based scans key off commits, not the working tree. - name: Stage scanner config - run: cp "_tool/${{ inputs.config_path }}" ./ + env: + CONFIG_PATH: ${{ inputs.config_path }} + run: cp "_tool/${CONFIG_PATH}" ./ - name: Set up Python uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 @@ -144,7 +146,8 @@ jobs: ZIZMOR_SEVERITY_THRESHOLD: ${{ inputs.severity_threshold }} ZIZMOR_PERSONA: ${{ inputs.persona }} GH_TOKEN: ${{ github.token }} - run: python "_tool/${{ inputs.script_path }}" + SCRIPT_PATH: ${{ inputs.script_path }} + run: python "_tool/${SCRIPT_PATH}" - name: Upload SARIF report to code scanning if: always() && steps.scan.outputs.sarif_path != '' From 9834d61314d6d1799ab1de378fe8d45d3009a597 Mon Sep 17 00:00:00 2001 From: Laura Promberger Date: Wed, 22 Jul 2026 12:18:00 +0200 Subject: [PATCH 6/8] fix writing to security events tab? --- .github/workflows/_security_scan.yml | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/.github/workflows/_security_scan.yml b/.github/workflows/_security_scan.yml index 6abce9044..71009eb85 100644 --- a/.github/workflows/_security_scan.yml +++ b/.github/workflows/_security_scan.yml @@ -78,7 +78,10 @@ jobs: scan: name: ${{ inputs.tool }} scan runs-on: ubuntu-24.04 - timeout-minutes: 30 + timeout-minutes: 5 + permissions: + contents: read + security-events: write steps: # PR-aware checkout depth: PR commits + merge base lets the scanner # walk base..head; full history (0) for everything else. GHA @@ -149,8 +152,16 @@ jobs: SCRIPT_PATH: ${{ inputs.script_path }} run: python "_tool/${SCRIPT_PATH}" + # Fork PRs run with a read-only GITHUB_TOKEN regardless of the + # requested permissions, so the code-scanning upload would fail with + # "Resource not accessible by integration". Skip it for forks -- + # findings still fail the job (bandit/zizmor) and appear in the log. - name: Upload SARIF report to code scanning - if: always() && steps.scan.outputs.sarif_path != '' + if: >- + always() + && steps.scan.outputs.sarif_path != '' + && (github.event_name != 'pull_request' + || github.event.pull_request.head.repo.full_name == github.repository) uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 with: sarif_file: ${{ steps.scan.outputs.sarif_path }} From 5777c321c9932388c896b44a27e6ae144b535540 Mon Sep 17 00:00:00 2001 From: Laura Promberger Date: Wed, 22 Jul 2026 12:32:24 +0200 Subject: [PATCH 7/8] better? --- .github/workflows/_security_scan.yml | 12 +++++++----- .github/workflows/bandit.yml | 2 ++ .github/workflows/gitleaks_scheduled.yml | 2 ++ .github/workflows/zizmor.yml | 2 ++ 4 files changed, 13 insertions(+), 5 deletions(-) diff --git a/.github/workflows/_security_scan.yml b/.github/workflows/_security_scan.yml index 71009eb85..0790a6979 100644 --- a/.github/workflows/_security_scan.yml +++ b/.github/workflows/_security_scan.yml @@ -71,17 +71,19 @@ on: type: string default: regular -permissions: - contents: read +# No permissions block here on purpose. A reusable workflow inherits the +# token its caller grants; declaring scopes here that a caller doesn't +# grant makes that caller fail at startup. So each caller is the single +# source of truth for its own scopes -- CSV-only callers grant just +# `contents: read`, SARIF callers additionally grant `security-events: +# write` (code-scanning API) and `actions: read` (private-repo +# workflow-run lookup that upload-sarif performs). jobs: scan: name: ${{ inputs.tool }} scan runs-on: ubuntu-24.04 timeout-minutes: 5 - permissions: - contents: read - security-events: write steps: # PR-aware checkout depth: PR commits + merge base lets the scanner # walk base..head; full history (0) for everything else. GHA diff --git a/.github/workflows/bandit.yml b/.github/workflows/bandit.yml index 78c1548f3..af92db2be 100644 --- a/.github/workflows/bandit.yml +++ b/.github/workflows/bandit.yml @@ -34,3 +34,5 @@ jobs: # appear under Security -> Code scanning, filterable by # `Tool: Bandit` separately from any other scanner. security-events: write + # Private-repo requirement for upload-sarif (workflow-run lookup). + actions: read diff --git a/.github/workflows/gitleaks_scheduled.yml b/.github/workflows/gitleaks_scheduled.yml index ebfd8bced..732dfc5bb 100644 --- a/.github/workflows/gitleaks_scheduled.yml +++ b/.github/workflows/gitleaks_scheduled.yml @@ -34,3 +34,5 @@ jobs: # appear under Security -> Code scanning, filterable by # `Tool: gitleaks` separately from any other scanner. security-events: write + # Private-repo requirement for upload-sarif (workflow-run lookup). + actions: read diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index ec7557a70..72da45972 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -32,3 +32,5 @@ jobs: # appear under Security -> Code scanning, filterable by # `Tool: zizmor` separately from any other scanner. security-events: write + # Private-repo requirement for upload-sarif (workflow-run lookup). + actions: read From d8f86b30fe59daf9222ba84433ea59c8f017f01b Mon Sep 17 00:00:00 2001 From: Laura Promberger Date: Wed, 22 Jul 2026 13:35:08 +0200 Subject: [PATCH 8/8] add cooldown before applying version changes via dependabot --- .github/dependabot.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 7996690bf..0a9e39235 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -12,3 +12,5 @@ updates: github-actions: patterns: - "*" + cooldown: + default-days: 7