Skip to content

ci: enable the Pulse vulnerability and malware scans in the Security … #3239

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
gmanal wants to merge 2 commits into
base: main
Choose a base branch
from
Open

ci: enable the Pulse vulnerability and malware scans in the Security … #3239

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
538bef3
ci: enable the Pulse vulnerability and malware scans in the Security …
gmanal Oct 27, 2026
aa743d9
ci: trial vuln-build for the Pulse OSS scan
gmanal Oct 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 18 additions & 2 deletions .github/workflows/security-suite.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,12 @@
#
# SPDX-License-Identifier: Apache-2.0
#
# CI security scanning via the NVIDIA/security-workflows suite: Pulse secret scan + CodeQL SAST.
# CI security scanning via the NVIDIA/security-workflows suite: Pulse secret scan,
# Pulse OSS vulnerability scan (SCA), Pulse malware scan, and CodeQL SAST.
# Pulse runs on Linux nv-gha-runners (Docker image + OIDC/Vault) — Linux-only by design.
# The local secret-scan-trufflehog pre-commit hook is cross-platform (Linux/macOS/Windows).
# Pinned to a reviewed commit SHA.
# The vulnerability and malware scans cross a Charon tunnel; see ci/README.md.

name: Security Suite (Pulse + CodeQL)

Expand Down Expand Up @@ -36,9 +38,11 @@ jobs:
if: >-
github.repository == 'NVIDIA/cuda-python' ||
vars.CI_CUSTOMIZATIONS_SECURITY_SUITE_ENABLED == 'true'
uses: NVIDIA/security-workflows/.github/workflows/security-suite.yml@c736f0454dc99764a66af6b906adfcdfbf621985 # v0.4.0
uses: NVIDIA/security-workflows/.github/workflows/security-suite.yml@2194c521256bb3a7bf6fa36add89d9ce3db17c9a # test/vuln-malware-onboarding
with:
enable-secret-scan: true
enable-vuln-scan: true
enable-malware-scan: true
Comment on lines +44 to +45

@coderabbitai coderabbitai Bot Oct 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor · Stability & Availability · Quick win

important: Restrict tunnel-backed scans to authorized refs.

Lines 44-45 enable the scans for workflow_dispatch, but that event has no branch filter and the job condition does not check github.ref_name. A manual run from another branch starts the Charon-backed scans. The documented tenant authorization covers main, ctk-next, and pull-request/*; an unlisted ref returns 403, and scanner or transport errors fail the job. Add the authorized-ref condition to security-suite.if, or remove workflow_dispatch. (raw.githubusercontent.com)

Source: Path instructions

enable-sast-scan: true
secret-runs-on: linux-amd64-cpu4
# Set failure_policy explicitly so enforcement can't drift with upstream defaults.
Expand All @@ -48,3 +52,15 @@ jobs:
secret-failure-policy: unverified
# Same analysis the retired codeql.yml performed: python, build-mode none, security-extended.
sast-languages: '["python"]'
# Literal fallback until the NSPECT_ID variable is provisioned on this repository.
nspect-id: ${{ vars.NSPECT_ID || 'NSPECT-ZY2K-Y1V8' }}

@coderabbitai coderabbitai Bot Oct 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Major · Data Integrity & Integration · Quick win

important: Do not use cuda-python's nSpect ID as the fallback for alternate repositories.

If CI_CUSTOMIZATIONS_SECURITY_SUITE_ENABLED enables this workflow in another repository before that repository provisions vars.NSPECT_ID, this input sends NSPECT-ZY2K-Y1V8 to the scanner. The reusable workflow uses that ID with the caller's repository identity, so findings can be recorded against the wrong registration or fail authorization. Return an empty ID for non-canonical repositories and let the upstream preflight fail until their variable is provisioned. (raw.githubusercontent.com)

vuln-runs-on: linux-amd64-cpu4
# Diagnostic trial, not a settled choice: the buildless scan can't resolve this graph because
# Detect's setuptools and uv detectors both need the project installed. Revert if it doesn't help.
vuln-build: true
Comment on lines +58 to +60

@coderabbitai coderabbitai Bot Oct 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical · Security & Privacy · Heavy lift

critical: Do not enable build mode for untrusted pull-request mirrors with OIDC and Charon access.

The workflow scans pull-request/* mirror pushes, and vuln-build: true passes --build to Pulse. The Setuptools build path can install and execute project packaging code. The scanner container receives ACTIONS_ID_TOKEN_REQUEST_*, uses host networking, and reaches the Charon tunnel. A malicious pull request can therefore use scanner credentials or internal routes instead of only being scanned. Keep build mode disabled for untrusted refs, or isolate the build from OIDC and Charon access. (raw.githubusercontent.com)

As per path instructions, this crosses the security boundary between untrusted pull-request content and internal services.

Source: Path instructions

# report-only (default) — findings warn; fail-on-vulnerability — any finding fails. Errors always fail.
vuln-failure-policy: report-only
vuln-upload-report: true
malware-runs-on: linux-amd64-cpu4
# strict (default) — SUSPICIOUS fails too; malicious-only — it only warns. MALICIOUS always fails.
malware-failure-policy: strict
15 changes: 15 additions & 0 deletions ci/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -232,3 +232,18 @@ The canonical `NVIDIA/cuda-python` repository does not need this variable
because its standard workflow behavior is enabled directly. Before enabling a
customization elsewhere, document the repository-specific prerequisites and
verification procedure in that repository's own documentation.

### Security Suite scan prerequisites

The secret scan and CodeQL SAST need only the Vault variables already
provisioned for this repository. The Pulse OSS vulnerability scan and the Pulse
malware scan additionally reach NVIDIA-internal services through a Charon
tunnel, which authorizes **per repository and per ref**, and both read the
repository's `NSPECT_ID` Actions variable.

The Charon tenant must list every ref the suite scans — `main`, `ctk-next`, and
the `pull-request/*` mirrors — and grant the routes each scan calls, including
`POST /v1/sourceCode/scan`, which is not granted to tenants by default. An
unlisted ref or route surfaces as an opaque `403` from inside the scanner, so
confirm the tenant before debugging anything else. The secret scan and SAST are
unaffected; neither crosses the tunnel.
Loading