feat(security): onboard pre-commit and Pulse secret scanning - #2405
feat(security): onboard pre-commit and Pulse secret scanning#2405gmanal wants to merge 12 commits into
Conversation
|
5d5f33f to
2df9477
Compare
Onboard NVIDIA/security-workflows secret scanning: - .github/workflows/secret-scan-pulse.yml: call the Pulse reusable workflow (pinned by commit SHA) on pushes to main, ctk-next, and copy-pr-bot pull-request branches; runs on nv-cpu-general with the default unverified failure_policy. - .pre-commit-config.yaml: add the secret-scan-trufflehog local hook (pinned to security-workflows v0.1.0), skipped on pre-commit.ci which lacks the trufflehog binary. - CONTRIBUTING.md: document local secret-scan setup.
2df9477 to
c5c2cf8
Compare
… CI and Windows (Git Bash)
ff352f5 to
ff758ac
Compare
The pinned NVIDIA/security-workflows secret-scan-pulse.yml declares
actions: read in its own permissions block. A reusable workflow cannot
request more than the caller grants, so dropping actions: read from this
caller made the run fail at load time ("requesting actions: read, but is
only allowed actions: none"). Restore it.
|
Blocked by #2327 so that Windows developers can install |
|
|
||
| ## Secret Scanning | ||
|
|
||
| The `secret-scan-trufflehog` pre-commit hook scans staged files and installs TruffleHog on first run (use Git Bash on Windows). If it flags a secret, remove it before committing, or contact a maintainer if it's a false positive. Secrets are also scanned server-side in CI. |
There was a problem hiding this comment.
Can we not require Git Bash on Windows? Given the pre-commit hook is mostly just downloading the correct platform binary to use, I imagine we can implement it in a way that doesn't add any extra dependencies for developers?
There was a problem hiding this comment.
Good call.
as hook detects OS/arch, downloads a pinned TruffleHog release, verifies its SHA-256, caches it, and execs it. None of that needs a shell and can be achieved using python script as well.
The fix will be to move the wrapper to language: python. pre-commit is itself Python, so an interpreter is guaranteed on every platform, and the whole thing is stdlib: platform for arch detection, urllib.request to download, hashlib to verify, tarfile/zipfile to extract.
No Git Bash, no curl, no extra dependencies on any OS.
Do you want to hold this PR for this change? or can we move and add it later.
There was a problem hiding this comment.
I've opened NVIDIA/security-workflows#14 to address this upstream
4 participants
Description
Onboard NVIDIA secret scanning to cuda-python using the centrally maintained NVIDIA/security-workflows surfaces. Two complementary controls:
secret-scan-trufflehogpre-commit hook — catches credentials before commit.Changes
.github/workflows/secret-scan-pulse.ymlcalling the centralized Pulse reusable workflow, onmain,ctk-next, and copy-pr-botpull-request/*branches; runs onnv-cpu-general(onboarded for this repo in the enterprise runner config).secret-scan-trufflehogpre-commit hook (pinned tosecurity-workflowsv0.1.0), skipped on hosted pre-commit.ci which lacks the trufflehog binary.failure_policy: unverifiedexplicitly (fail on verified/live secrets, warn on unverified); fails closed on scanner/infra errors.revto release tagv0.1.0, workflowuses:to a reviewed commit SHA.Checklist