feat(security): onboard pre-commit and Pulse secret scanning#2405
feat(security): onboard pre-commit and Pulse secret scanning#2405gmanal wants to merge 2 commits into
Conversation
|
5d5f33f to
2df9477
Compare
Onboard NVIDIA/security-workflows secret scanning: - .github/workflows/secret-scan-pulse.yml: call the Pulse reusable workflow (pinned by commit SHA) on pushes to main, ctk-next, and copy-pr-bot pull-request branches; runs on nv-cpu-general with the default unverified failure_policy. - .pre-commit-config.yaml: add the secret-scan-trufflehog local hook (pinned to security-workflows v0.1.0), skipped on pre-commit.ci which lacks the trufflehog binary. - CONTRIBUTING.md: document local secret-scan setup.
2df9477 to
c5c2cf8
Compare
|
|
||
| Two complementary controls prevent accidental credential leakage: | ||
|
|
||
| - **Local pre-commit** (`secret-scan-trufflehog`, via `.pre-commit-config.yaml`): catches credentials before commit. Requires `trufflehog` on your PATH (the wrapper prints install commands if missing). Never commit a flagged secret; check with maintainers on false positives, and only use `git commit --no-verify` in exceptional, agreed cases. |
There was a problem hiding this comment.
This means that encouraging installation of pre-commit is even more important, as is making sure our pre-commit config works on Windows (which it currently doesn't).
| # pre-commit autoupdate --freeze | ||
| repos: | ||
| # Runs first so a leaked credential blocks the commit before any formatter runs. | ||
| # Requires `trufflehog` on $PATH; the wrapper prints install commands if missing. |
There was a problem hiding this comment.
Will this fail if not installed, or just warn (and continue to the other checks)?
The installation instructions mention an insecure installation method:
Install on macOS or Linux (no package manager required):
curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh \
| sh -s -- -b /usr/local/bin
Maybe this tool could install it in a safe way to the local pre-commit environment (the way other pre-commit hooks work).
| uses: NVIDIA/security-workflows/.github/workflows/secret-scan-pulse.yml@69032f641c3c34e0c0b46f636b54ed2b101b7aa4 | ||
| with: | ||
| runs-on: linux-amd64-cpu4 | ||
| # Set failure_policy explicitly so enforcement can't drift with upstream defaults. |
There was a problem hiding this comment.
Is the Linux-only execution context intentional? The called workflow relies on POSIX shell syntax, docker, and python3, while the local pre-commit hook is also Bash-only and documents no Windows installation path. If Windows developers are expected to use this hook, please add a supported Windows implementation/instructions; otherwise, please document that this control is Linux/macOS-only.
| permissions: | ||
| contents: read | ||
| id-token: write # OIDC -> Vault -> nvcr.io image pull | ||
| security-events: write # publish redacted SARIF to code scanning |
There was a problem hiding this comment.
NVIDIA/cuda-python is public. GitHub documents actions: read as required by upload-sarif only for private repositories; this workflow otherwise needs contents: read, id-token: write, and security-events: write. Could we drop actions: read here to keep the caller token at the minimum scope?
3 participants
Description
Onboard NVIDIA secret scanning to cuda-python using the centrally maintained NVIDIA/security-workflows surfaces. Two complementary controls:
secret-scan-trufflehogpre-commit hook — catches credentials before commit.Changes
.github/workflows/secret-scan-pulse.ymlcalling the centralized Pulse reusable workflow, onmain,ctk-next, and copy-pr-botpull-request/*branches; runs onnv-cpu-general(onboarded for this repo in the enterprise runner config).secret-scan-trufflehogpre-commit hook (pinned tosecurity-workflowsv0.1.0), skipped on hosted pre-commit.ci which lacks the trufflehog binary.failure_policy: unverifiedexplicitly (fail on verified/live secrets, warn on unverified); fails closed on scanner/infra errors.revto release tagv0.1.0, workflowuses:to a reviewed commit SHA.Checklist