Merge branch 'main' into enable-secret-scan #6

	# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
	#
	# SPDX-License-Identifier: Apache-2.0
	#
	# CI secret-scan enforcement via NVIDIA/security-workflows (Pulse).
	# Local advisory scanning is the secret-scan-trufflehog pre-commit hook.
	# Pinned to a reviewed commit SHA; bump when NVIDIA/security-workflows consolidates.

	name: Secret Scan (Pulse)

	on:
	push:
	branches:
	- main
	- ctk-next
	# copy-pr-bot mirror branches — trusted PR execution context
	- "pull-request/[0-9]+"
	workflow_dispatch:

	concurrency:
	group: ${{ github.workflow }}-on-${{ github.event_name }}-from-${{ github.ref_name }}
	cancel-in-progress: true

	# Caller permissions must cover the reusable workflow (intersection applies).
	permissions:
	contents: read
	id-token: write # OIDC -> Vault -> nvcr.io image pull
	security-events: write # publish redacted SARIF to code scanning
	actions: read # required by upload-sarif

	jobs:
	secret-scan:
	name: Secret Scan
	# Pulse needs nv-gha-runners + Vault/nvcr vars; skip on forks.
	if: github.repository == 'NVIDIA/cuda-python'
	uses: NVIDIA/security-workflows/.github/workflows/secret-scan-pulse.yml@69032f641c3c34e0c0b46f636b54ed2b101b7aa4
	with:
	runs-on: linux-amd64-cpu4
	# Set failure_policy explicitly so enforcement can't drift with upstream defaults.
	# unverified — fail on verified/live secrets (183); warn on unverified (185) [default]
	# strict — fail on any finding (verified or unverified)
	# all — warn only; never fail the job on findings
	failure_policy: unverified

Provide feedback