From e5f7daa2eeaf2b391285c60e9e593c7af890c9a0 Mon Sep 17 00:00:00 2001 From: Janusz Lisiecki Date: Mon, 8 Jun 2026 19:09:28 +0200 Subject: [PATCH 1/3] Add Secret scaning workflow - adds NVIDIA/security-workflows/.github/workflows/secret-scan-trufflehog.yml workflow Signed-off-by: Janusz Lisiecki --- .github/workflows/security.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 .github/workflows/security.yml diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml new file mode 100644 index 00000000000..72a51c86adc --- /dev/null +++ b/.github/workflows/security.yml @@ -0,0 +1,16 @@ +name: Secret Scan + +on: + pull_request: + branches: [ "main" ] + +permissions: + contents: read + +jobs: + secret-scan: + runs-on: ubuntu-latest + steps: + - uses: NVIDIA/security-workflows/.github/workflows/secret-scan-pulse.yml@031c5429271b5692e025c3e292fcc2bf11e116f7 + with: + fetch-depth: 0 \ No newline at end of file From 8316dd6f3c2ac7ee139bf6a0e99a372abd5a2b91 Mon Sep 17 00:00:00 2001 From: Janusz Lisiecki Date: Fri, 24 Jul 2026 15:55:15 +0200 Subject: [PATCH 2/3] Harden secret scanning workflow Signed-off-by: Janusz Lisiecki --- .githooks/pre-commit | 10 +++++++++- .github/workflows/security.yml | 13 +++++++------ .pre-commit-config.yaml | 5 +++++ 3 files changed, 21 insertions(+), 7 deletions(-) create mode 100644 .pre-commit-config.yaml diff --git a/.githooks/pre-commit b/.githooks/pre-commit index 3167e1086a8..b7fb89c0663 100755 --- a/.githooks/pre-commit +++ b/.githooks/pre-commit @@ -1,6 +1,6 @@ #!/bin/sh -# Copyright (c) 2021, NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# Copyright (c) 2021, 2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -14,6 +14,14 @@ # See the License for the specific language governing permissions and # limitations under the License. +# Check staged content for leaked secrets +if command -v pre-commit >/dev/null 2>&1; then + pre-commit run --hook-stage pre-commit || exit $? +else + echo "pre-commit is required to run the secret-scan hook." + exit 1 +fi + # Check copyright notice files=`git diff --cached --name-only` year=`date +%Y` diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 72a51c86adc..ed8e5344418 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -1,16 +1,17 @@ name: Secret Scan on: + push: + branches: [ "main" ] pull_request: branches: [ "main" ] permissions: - contents: read + actions: read + contents: read + id-token: write + security-events: write jobs: secret-scan: - runs-on: ubuntu-latest - steps: - - uses: NVIDIA/security-workflows/.github/workflows/secret-scan-pulse.yml@031c5429271b5692e025c3e292fcc2bf11e116f7 - with: - fetch-depth: 0 \ No newline at end of file + uses: NVIDIA/security-workflows/.github/workflows/secret-scan-pulse.yml@031c5429271b5692e025c3e292fcc2bf11e116f7 diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml new file mode 100644 index 00000000000..299ad9ba1db --- /dev/null +++ b/.pre-commit-config.yaml @@ -0,0 +1,5 @@ +repos: + - repo: https://github.com/NVIDIA/security-workflows + rev: v0.2.0 + hooks: + - id: secret-scan-trufflehog From 0c70306d6c9afdc0ecbc0a89b614d36f721c393c Mon Sep 17 00:00:00 2001 From: Janusz Lisiecki Date: Fri, 24 Jul 2026 15:59:51 +0200 Subject: [PATCH 3/3] Run secret scan on hosted runners Signed-off-by: Janusz Lisiecki --- .github/workflows/security.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index ed8e5344418..fb0803a41d3 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -15,3 +15,5 @@ permissions: jobs: secret-scan: uses: NVIDIA/security-workflows/.github/workflows/secret-scan-pulse.yml@031c5429271b5692e025c3e292fcc2bf11e116f7 + with: + runs-on: ubuntu-latest