v0.2.0 — Self-installing secret-scan pre-commit hook

v0.2.0 — Self-installing secret-scan pre-commit hook

This release makes the secret-scan-trufflehog pre-commit hook install nothing manually. On first use it fetches a pinned, checksum-verified TruffleHog release into a per-user cache and reuses it thereafter — the same "it just works" experience contributors expect from hooks like clang-format. The CI (Pulse) surface is unchanged.

Why this matters

• Zero-setup for contributors. No brew install / curl | sh / PATH juggling — the hook provisions its own pinned scanner on the first commit.
• Cross-platform. Linux, macOS, and Windows (via Git Bash/MSYS), on both amd64 and arm64.
• Supply-chain safe. The binary is downloaded over HTTPS and verified against a per-platform SHA-256 pinned from TruffleHog's cosign-signed checksums.txt; the hook fails closed on any mismatch and never executes an unverified binary.

What changed since v0.1.0

• The secret-scan-trufflehog hook wrapper now self-installs TruffleHog 3.95.9:
  • Downloads the official release archive for the detected OS/arch.
  • Verifies it against a pinned SHA-256 (fail-closed).
  • Caches it under ${XDG_CACHE_HOME:-~/.cache}/nvidia-security-workflows/trufflehog/<version>/ and reuses it offline on subsequent runs.
• Added Windows support (Git Bash/MSYS) alongside Linux and macOS.
• Documentation updated; the previous, incorrect manual-install guidance (pip install trufflehog, which resolves to a deprecated unrelated tool) has been removed.

Compatibility

• Drop-in for existing consumers. The hook id, arguments (--results=verified), stages, and default behavior are unchanged — only how the binary is obtained changed.
• No CI/workflow change. The Pulse reusable workflow (secret-scan-pulse.yml) and its failure_policy model are identical to v0.1.0.

Requirements (new)

• Network access to github.com on the first run per version (subsequent runs are offline).
• curl or wget, tar, and sha256sum/shasum available — standard on Linux/macOS and bundled with Git for Windows.
• Windows contributors must run within a Git Bash/MSYS environment.

How to upgrade

Bump the pre-commit pin from v0.1.0 to v0.2.0 in your .pre-commit-config.yaml:

repos:
  - repo: https://github.com/NVIDIA/security-workflows
    rev: v0.2.0
    hooks:
      - id: secret-scan-trufflehog

The reusable-workflow uses: pin (by commit SHA) is unaffected by this release.

Pinning policy (unchanged)

• Pre-commit rev: -> release tag (this tag, v0.2.0).
• Workflow uses: -> 40-character commit SHA.

Full detail in CHANGELOG.md. Pre-1.0: interfaces may still change in a minor release while the surfaces stabilize with ProdSec.

v0.1.0 — Secret scanning (pilot)

The first release of NVIDIA Security Workflows — the single, centrally maintained source for security-compliance scanning across NVIDIA's GitHub repositories.
This pilot delivers the secret-scanning capability across both the developer and CI surfaces, so a leaked credential is caught locally before commit and enforced server-side before merge.

Why this matters

• One source of truth. Consumers reference a pinned, reviewed workflow instead of copying scanner logic into every repository.
• Defense in depth. A fast local advisory check plus authoritative, fail-closed CI enforcement — complementary layers, not alternatives.
• Safe by default. Findings are published as redacted SARIF to the Security tab; raw scanner output never reaches job logs; scanner or infrastructure errors fail closed.

What's included

Surface	Component	Role
CI enforcement	Reusable workflow secret-scan-pulse.yml	Runs NVIDIA's licensed Pulse Secret Scanner (TruffleHog Enterprise) on nv-gha-runners; publishes redacted SARIF to code scanning.
Local advisory	Pre-commit hook secret-scan-trufflehog	Runs open-source TruffleHog on the developer's machine before commit/push.

Enforcement model

Enforcement is controlled by a single failure_policy input, with names aligned to the GitLab secret-scan component for a consistent experience across platforms:

failure_policy	Verified/live secret	Unverified finding
unverified (default)	fail	warn (job stays green)
strict	fail	fail
all	warn	warn

Scanner, Vault, registry, or runner errors always fail the job.

How to consume

CI (reusable workflow) — pin by 40-character commit SHA:

permissions:
  contents: read
  id-token: write
  security-events: write
  actions: read

jobs:
  secret-scan:
    uses: NVIDIA/security-workflows/.github/workflows/secret-scan-pulse.yml@<COMMIT-SHA>
    with:
      runs-on: <your-nv-gha-runner-label>