Add Secret scanning workflow

.githooks/pre-commit

@@ -1,6 +1,6 @@
 #!/bin/sh
 
-# Copyright (c) 2021, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# Copyright (c) 2021, 2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -14,6 +14,14 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# Check staged content for leaked secrets
+if command -v pre-commit >/dev/null 2>&1; then
+    pre-commit run --hook-stage pre-commit || exit $?
+else
+    echo "pre-commit is required to run the secret-scan hook."
+    exit 1
+fi
+
 # Check copyright notice
 files=`git diff --cached --name-only`
 year=`date +%Y`

.github/workflows/security.yml

@@ -0,0 +1,19 @@
+name: Secret Scan
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+
+permissions:
+  actions: read
+  contents: read
+  id-token: write
+  security-events: write
+
+jobs:
+  secret-scan:
+    uses: NVIDIA/security-workflows/.github/workflows/secret-scan-pulse.yml@031c5429271b5692e025c3e292fcc2bf11e116f7
+    with:
+      runs-on: ubuntu-latest

.pre-commit-config.yaml

@@ -0,0 +1,5 @@
+repos:
+  - repo: https://github.com/NVIDIA/security-workflows
+    rev: v0.2.0
+    hooks:
+      - id: secret-scan-trufflehog