Address review: drop actions:read on public repo; document Linux-only… #7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | ||
| # | ||
| # SPDX-License-Identifier: Apache-2.0 | ||
| # | ||
| # CI secret-scan enforcement via NVIDIA/security-workflows (Pulse). | ||
| # Runs on Linux nv-gha-runners (Pulse Docker image + OIDC/Vault) — Linux-only by design. | ||
| # The local secret-scan-trufflehog pre-commit hook is cross-platform (Linux/macOS/Windows via Git Bash). | ||
| # Pinned to a reviewed commit SHA; bump when NVIDIA/security-workflows consolidates. | ||
| name: Secret Scan (Pulse) | ||
| on: | ||
| push: | ||
| branches: | ||
| - main | ||
| - ctk-next | ||
| # copy-pr-bot mirror branches — trusted PR execution context | ||
| - "pull-request/[0-9]+" | ||
| workflow_dispatch: | ||
| concurrency: | ||
| group: ${{ github.workflow }}-on-${{ github.event_name }}-from-${{ github.ref_name }} | ||
| cancel-in-progress: true | ||
| # Caller permissions must cover the reusable workflow (intersection applies). | ||
| permissions: | ||
| contents: read | ||
| id-token: write # OIDC -> Vault -> nvcr.io image pull | ||
| security-events: write # publish redacted SARIF to code scanning | ||
| jobs: | ||
| secret-scan: | ||
|
Check failure on line 32 in .github/workflows/secret-scan-pulse.yml
|
||
| name: Secret Scan | ||
| # Pulse needs nv-gha-runners + Vault/nvcr vars; skip on forks. | ||
| if: github.repository == 'NVIDIA/cuda-python' | ||
| uses: NVIDIA/security-workflows/.github/workflows/secret-scan-pulse.yml@69032f641c3c34e0c0b46f636b54ed2b101b7aa4 | ||
| with: | ||
| runs-on: linux-amd64-cpu4 | ||
| # Set failure_policy explicitly so enforcement can't drift with upstream defaults. | ||
| # unverified — fail on verified/live secrets (183); warn on unverified (185) [default] | ||
| # strict — fail on any finding (verified or unverified) | ||
| # all — warn only; never fail the job on findings | ||
| failure_policy: unverified | ||
