Repository navigation
Conversation
📝 Summary
Priority: Change: Feature Merge Risk:
 |
c6bbbae to
2f0e7cf
Compare
…Suite Turns on `enable-vuln-scan` and `enable-malware-scan` and repins the suite to NVIDIA/security-workflows test/vuln-malware-onboarding, the branch carrying the 0.5.0 release notes for both scans. The vulnerability scan starts report-only so a finding baseline can be built before it gates merges; scanner and transport errors still fail the job, and inventory writeback stays off. The malware scan keeps the upstream default of strict, where SUSPICIOUS blocks as well as MALICIOUS. Both scans report to the same nSpect registration, because an nSpect ID identifies the repository rather than one scan. `nspect-id` reads the `NSPECT_ID` Actions variable and falls back to this repository's ID literally, so the suite works whether or not the variable has been provisioned; drop the fallback once it has. No permission change: the suite's union is contents/actions read plus id-token and security-events write, all of which this caller already grants. Both scans cross a Charon tunnel that authorizes per repository and per ref. charon!242 brings this repository's tenant to parity with the one the upstream workflows are tested against and grants `main` plus the `pull-request/*` mirrors; the prerequisites are summarised in ci/README.md.
2f0e7cf to
538bef3
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to GitHub limitations.
security-suite.yml:56
.github/workflows/security-suite.yml:56
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winimportant: Scope the nSpect fallback to this repository.
Line 56 applies
NSPECT-ZY2K-Y1V8to every caller whenvars.NSPECT_IDis empty. The job condition also permits another repository to opt in throughCI_CUSTOMIZATIONS_SECURITY_SUITE_ENABLED. The reusable workflow definesnspect-idas the calling repository's registration, so another repository can attribute both scan results to cuda-python's registration. Scope the fallback toNVIDIA/cuda-pythonand fail or skip when another repository has noNSPECT_ID. (raw.githubusercontent.com)Source: Path instructions
-
-
- Source mode: Auto
- Repository: NVIDIA/cuda-python
- Branch: main
- File: .coderabbit.yaml
- Commit: 590a8bf
- Layers: Repository YAML
- Review profile: CHILL
- Plan: Enterprise
- Run ID:
6a8de3fc-b2c9-4bc1-bfb8-beb92c5fa8bc
-
.github/workflows/security-suite.yml
Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 10 remain after this review.
-
| enable-vuln-scan: true | ||
| enable-malware-scan: true |
There was a problem hiding this comment.
important: Restrict tunnel-backed scans to authorized refs.
Lines 44-45 enable the scans for workflow_dispatch, but that event has no branch filter and the job condition does not check github.ref_name. A manual run from another branch starts the Charon-backed scans. The documented tenant authorization covers main, ctk-next, and pull-request/*; an unlisted ref returns 403, and scanner or transport errors fail the job. Add the authorized-ref condition to security-suite.if, or remove workflow_dispatch. (raw.githubusercontent.com)
Source: Path instructions
|
Turns on
enable-vuln-scanandenable-malware-scanand repins the suite to NVIDIA/security-workflows test/vuln-malware-onboarding, the branch carrying the 0.5.0 release notes for both scans.The vulnerability scan starts report-only so a finding baseline can be built before it gates merges; scanner and transport errors still fail the job, and inventory writeback stays off. The malware scan keeps the upstream default of strict, where SUSPICIOUS blocks as well as MALICIOUS.
Both scans report to the same nSpect registration, because an nSpect ID identifies the repository rather than one scan.
nspect-idreads theNSPECT_IDActions variable and falls back to this repository's ID literally, so the suite works whether or not the variable has been provisioned; drop the fallback once it has.No permission change: the suite's union is contents/actions read plus id-token and security-events write, all of which this caller already grants.
Both scans cross a Charon tunnel that authorizes per repository and per ref. charon!242 brings this repository's tenant to parity with the one the upstream workflows are tested against and grants
mainplus thepull-request/*mirrors; the prerequisites are summarised in ci/README.md.Description
closes
Checklist