From 538bef3995c588ab971609f6d2116e3bea228b1b Mon Sep 17 00:00:00 2001 From: gmanal Date: Tue, 27 Oct 2026 13:06:29 +0530 Subject: [PATCH 1/2] ci: enable the Pulse vulnerability and malware scans in the Security Suite Turns on `enable-vuln-scan` and `enable-malware-scan` and repins the suite to NVIDIA/security-workflows test/vuln-malware-onboarding, the branch carrying the 0.5.0 release notes for both scans. The vulnerability scan starts report-only so a finding baseline can be built before it gates merges; scanner and transport errors still fail the job, and inventory writeback stays off. The malware scan keeps the upstream default of strict, where SUSPICIOUS blocks as well as MALICIOUS. Both scans report to the same nSpect registration, because an nSpect ID identifies the repository rather than one scan. `nspect-id` reads the `NSPECT_ID` Actions variable and falls back to this repository's ID literally, so the suite works whether or not the variable has been provisioned; drop the fallback once it has. No permission change: the suite's union is contents/actions read plus id-token and security-events write, all of which this caller already grants. Both scans cross a Charon tunnel that authorizes per repository and per ref. charon!242 brings this repository's tenant to parity with the one the upstream workflows are tested against and grants `main` plus the `pull-request/*` mirrors; the prerequisites are summarised in ci/README.md. --- .github/workflows/security-suite.yml | 17 +++++++++++++++-- ci/README.md | 15 +++++++++++++++ 2 files changed, 30 insertions(+), 2 deletions(-) diff --git a/.github/workflows/security-suite.yml b/.github/workflows/security-suite.yml index 64eb4846483..fc74bbf3e83 100644 --- a/.github/workflows/security-suite.yml +++ b/.github/workflows/security-suite.yml @@ -2,10 +2,12 @@ # # SPDX-License-Identifier: Apache-2.0 # -# CI security scanning via the NVIDIA/security-workflows suite: Pulse secret scan + CodeQL SAST. +# CI security scanning via the NVIDIA/security-workflows suite: Pulse secret scan, +# Pulse OSS vulnerability scan (SCA), Pulse malware scan, and CodeQL SAST. # Pulse runs on Linux nv-gha-runners (Docker image + OIDC/Vault) — Linux-only by design. # The local secret-scan-trufflehog pre-commit hook is cross-platform (Linux/macOS/Windows). # Pinned to a reviewed commit SHA. +# The vulnerability and malware scans cross a Charon tunnel; see ci/README.md. name: Security Suite (Pulse + CodeQL) @@ -36,9 +38,11 @@ jobs: if: >- github.repository == 'NVIDIA/cuda-python' || vars.CI_CUSTOMIZATIONS_SECURITY_SUITE_ENABLED == 'true' - uses: NVIDIA/security-workflows/.github/workflows/security-suite.yml@c736f0454dc99764a66af6b906adfcdfbf621985 # v0.4.0 + uses: NVIDIA/security-workflows/.github/workflows/security-suite.yml@2194c521256bb3a7bf6fa36add89d9ce3db17c9a # test/vuln-malware-onboarding with: enable-secret-scan: true + enable-vuln-scan: true + enable-malware-scan: true enable-sast-scan: true secret-runs-on: linux-amd64-cpu4 # Set failure_policy explicitly so enforcement can't drift with upstream defaults. @@ -48,3 +52,12 @@ jobs: secret-failure-policy: unverified # Same analysis the retired codeql.yml performed: python, build-mode none, security-extended. sast-languages: '["python"]' + # Literal fallback until the NSPECT_ID variable is provisioned on this repository. + nspect-id: ${{ vars.NSPECT_ID || 'NSPECT-ZY2K-Y1V8' }} + vuln-runs-on: linux-amd64-cpu4 + # report-only (default) — findings warn; fail-on-vulnerability — any finding fails. Errors always fail. + vuln-failure-policy: report-only + vuln-upload-report: true + malware-runs-on: linux-amd64-cpu4 + # strict (default) — SUSPICIOUS fails too; malicious-only — it only warns. MALICIOUS always fails. + malware-failure-policy: strict diff --git a/ci/README.md b/ci/README.md index 2fcd5b4ab1d..aa635a43614 100644 --- a/ci/README.md +++ b/ci/README.md @@ -232,3 +232,18 @@ The canonical `NVIDIA/cuda-python` repository does not need this variable because its standard workflow behavior is enabled directly. Before enabling a customization elsewhere, document the repository-specific prerequisites and verification procedure in that repository's own documentation. + +### Security Suite scan prerequisites + +The secret scan and CodeQL SAST need only the Vault variables already +provisioned for this repository. The Pulse OSS vulnerability scan and the Pulse +malware scan additionally reach NVIDIA-internal services through a Charon +tunnel, which authorizes **per repository and per ref**, and both read the +repository's `NSPECT_ID` Actions variable. + +The Charon tenant must list every ref the suite scans — `main`, `ctk-next`, and +the `pull-request/*` mirrors — and grant the routes each scan calls, including +`POST /v1/sourceCode/scan`, which is not granted to tenants by default. An +unlisted ref or route surfaces as an opaque `403` from inside the scanner, so +confirm the tenant before debugging anything else. The secret scan and SAST are +unaffected; neither crosses the tunnel. From aa743d966000a65737b5e5a68fc6b1d0d947ea1b Mon Sep 17 00:00:00 2001 From: gmanal Date: Tue, 27 Oct 2026 15:30:48 +0530 Subject: [PATCH 2/2] ci: trial vuln-build for the Pulse OSS scan The buildless scan cannot resolve cuda-python's dependency graph: Detect's SETUPTOOLS detector needs 'pip show' output and its UV detector builds the project editable, so both fail under --no-build and Detect reports a non-zero status. Try build mode once to establish whether a full build resolves the graph before escalating to Pulse. --- .github/workflows/security-suite.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/security-suite.yml b/.github/workflows/security-suite.yml index fc74bbf3e83..0a6dfa90e92 100644 --- a/.github/workflows/security-suite.yml +++ b/.github/workflows/security-suite.yml @@ -55,6 +55,9 @@ jobs: # Literal fallback until the NSPECT_ID variable is provisioned on this repository. nspect-id: ${{ vars.NSPECT_ID || 'NSPECT-ZY2K-Y1V8' }} vuln-runs-on: linux-amd64-cpu4 + # Diagnostic trial, not a settled choice: the buildless scan can't resolve this graph because + # Detect's setuptools and uv detectors both need the project installed. Revert if it doesn't help. + vuln-build: true # report-only (default) — findings warn; fail-on-vulnerability — any finding fails. Errors always fail. vuln-failure-policy: report-only vuln-upload-report: true