Address review: drop actions:read on public repo; document Linux-only CI and Windows (Git Bash)

Author: gmanal

.github/workflows/secret-scan-pulse.yml

@@ -3,7 +3,8 @@
 # SPDX-License-Identifier: Apache-2.0
 #
 # CI secret-scan enforcement via NVIDIA/security-workflows (Pulse).
-# Local advisory scanning is the secret-scan-trufflehog pre-commit hook.
+# Runs on Linux nv-gha-runners (Pulse Docker image + OIDC/Vault) — Linux-only by design.
+# The local secret-scan-trufflehog pre-commit hook is cross-platform (Linux/macOS/Windows via Git Bash).
 # Pinned to a reviewed commit SHA; bump when NVIDIA/security-workflows consolidates.
 
 name: Secret Scan (Pulse)
@@ -26,7 +27,6 @@ permissions:
   contents: read
   id-token: write          # OIDC -> Vault -> nvcr.io image pull
   security-events: write   # publish redacted SARIF to code scanning
-  actions: read            # required by upload-sarif
 
 jobs:
   secret-scan:

CONTRIBUTING.md

@@ -79,10 +79,10 @@ warning reminding you to run `pre-commit install`.
 
 Two complementary controls prevent accidental credential leakage:
 
-- **Local pre-commit** (`secret-scan-trufflehog`, via `.pre-commit-config.yaml`): catches credentials before commit. Requires `trufflehog` on your PATH (the wrapper prints install commands if missing). Never commit a flagged secret; check with maintainers on false positives, and only use `git commit --no-verify` in exceptional, agreed cases.
-- **Server-side enforcement** (Pulse reusable workflow from `NVIDIA/security-workflows`, pinned by SHA): runs on `main`, `ctk-next`, and trusted copy-pr-bot branches, and blocks merges on verified secrets.
+- **Local pre-commit** (`secret-scan-trufflehog`, via `.pre-commit-config.yaml`): catches credentials before commit. Self-installing — no manual setup beyond `pre-commit install`; the hook downloads a pinned, checksum-verified `trufflehog` on first use. Never commit a flagged secret; check with maintainers on false positives, and only use `git commit --no-verify` in exceptional, agreed cases.
+- **Server-side enforcement** (Pulse reusable workflow from `NVIDIA/security-workflows`, pinned by SHA): runs on `main`, `ctk-next`, and trusted copy-pr-bot branches on Linux runners, and blocks merges on verified secrets.
 
-The local hook is skipped on hosted pre-commit.ci (no `trufflehog` binary there); Pulse remains the authoritative CI enforcement.
+The local hook is skipped on hosted pre-commit.ci (no `trufflehog` binary there); Pulse remains the authoritative CI enforcement. On **Windows**, run the hook from a Git Bash / MSYS shell (bundled with Git for Windows), which the hook requires; the CI (Pulse) control is Linux-runner-only by design.
 
 
 ## Signing Your Work