Skip to content

ci: enable the Pulse vulnerability and malware scans in the Security … #3239

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
gmanal wants to merge 5 commits into
base: main
Choose a base branch
from
Draft

ci: enable the Pulse vulnerability and malware scans in the Security … #3239

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
59e7442
ci: enable the Pulse vulnerability and malware scans in the Security …
gmanal Oct 27, 2026
425a09c
Merge branch 'main' into test/vuln-malware-onboarding
gmanal Oct 28, 2026
bb07086
ci: restore a scoped nSpect ID fallback for the Security Suite
gmanal Oct 28, 2026
5d8f919
ci: pin the Security Suite to security-workflows main
gmanal Oct 28, 2026
9a2dd68
ci: pin the Security Suite to security-workflows malware-vuln-onboarding
gmanal Oct 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 16 additions & 2 deletions .github/workflows/security-suite.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,12 @@
#
# SPDX-License-Identifier: Apache-2.0
#
# CI security scanning via the NVIDIA/security-workflows suite: Pulse secret scan + CodeQL SAST.
# CI security scanning via the NVIDIA/security-workflows suite: Pulse secret scan,
# Pulse OSS vulnerability scan (SCA), Pulse malware scan, and CodeQL SAST.
# Pulse runs on Linux nv-gha-runners (Docker image + OIDC/Vault) — Linux-only by design.
# The local secret-scan-trufflehog pre-commit hook is cross-platform (Linux/macOS/Windows).
# Pinned to a reviewed commit SHA.
# The vulnerability and malware scans cross a Charon tunnel; see ci/README.md.

name: Security Suite (Pulse + CodeQL)

Expand Down Expand Up @@ -36,9 +38,11 @@ jobs:
if: >-
github.repository == 'NVIDIA/cuda-python' ||
vars.CI_CUSTOMIZATIONS_SECURITY_SUITE_ENABLED == 'true'
uses: NVIDIA/security-workflows/.github/workflows/security-suite.yml@c736f0454dc99764a66af6b906adfcdfbf621985 # v0.4.0
uses: NVIDIA/security-workflows/.github/workflows/security-suite.yml@fd1f966240bf29723679039892dc863ca6d3adb9 # malware-vuln-onboarding
with:
enable-secret-scan: true
enable-vuln-scan: true
enable-malware-scan: true
Comment on lines +44 to +45

@coderabbitai coderabbitai Bot Oct 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor · Stability & Availability · Quick win

important: Restrict tunnel-backed scans to authorized refs.

Lines 44-45 enable the scans for workflow_dispatch, but that event has no branch filter and the job condition does not check github.ref_name. A manual run from another branch starts the Charon-backed scans. The documented tenant authorization covers main, ctk-next, and pull-request/*; an unlisted ref returns 403, and scanner or transport errors fail the job. Add the authorized-ref condition to security-suite.if, or remove workflow_dispatch. (raw.githubusercontent.com)

Source: Path instructions

enable-sast-scan: true
secret-runs-on: linux-amd64-cpu4
# Set failure_policy explicitly so enforcement can't drift with upstream defaults.
Expand All @@ -48,3 +52,13 @@ jobs:
secret-failure-policy: unverified
# Same analysis the retired codeql.yml performed: python, build-mode none, security-extended.
sast-languages: '["python"]'
# NSPECT_ID must be an Actions *variable*: a reusable workflow's inputs cannot read secrets.
# Literal fallback until it is provisioned, scoped so no other caller inherits this registration.
nspect-id: ${{ vars.NSPECT_ID || (github.repository == 'NVIDIA/cuda-python' && 'NSPECT-ZY2K-Y1V8' || '') }}
vuln-runs-on: linux-amd64-cpu4
# report-only (default) — findings warn; fail-on-vulnerability — any finding fails. Errors always fail.
vuln-failure-policy: report-only
vuln-upload-report: true
malware-runs-on: linux-amd64-cpu4
# strict (default) — SUSPICIOUS fails too; malicious-only — it only warns. MALICIOUS always fails.
malware-failure-policy: strict
15 changes: 15 additions & 0 deletions ci/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -232,3 +232,18 @@ The canonical `NVIDIA/cuda-python` repository does not need this variable
because its standard workflow behavior is enabled directly. Before enabling a
customization elsewhere, document the repository-specific prerequisites and
verification procedure in that repository's own documentation.

### Security Suite scan prerequisites

The secret scan and CodeQL SAST need only the Vault variables already
provisioned for this repository. The Pulse OSS vulnerability scan and the Pulse
malware scan additionally reach NVIDIA-internal services through a Charon
tunnel, which authorizes **per repository and per ref**, and both read the
repository's `NSPECT_ID` Actions variable.

The Charon tenant must list every ref the suite scans — `main`, `ctk-next`, and
the `pull-request/*` mirrors — and grant the routes each scan calls, including
`POST /v1/sourceCode/scan`, which is not granted to tenants by default. An
unlisted ref or route surfaces as an opaque `403` from inside the scanner, so
confirm the tenant before debugging anything else. The secret scan and SAST are
unaffected; neither crosses the tunnel.
Loading