v0.1.0 — Secret scanning (pilot)

The first release of NVIDIA Security Workflows — the single, centrally maintained source for security-compliance scanning across NVIDIA's GitHub repositories.
This pilot delivers the secret-scanning capability across both the developer and CI surfaces, so a leaked credential is caught locally before commit and enforced server-side before merge.

Why this matters

• One source of truth. Consumers reference a pinned, reviewed workflow instead of copying scanner logic into every repository.
• Defense in depth. A fast local advisory check plus authoritative, fail-closed CI enforcement — complementary layers, not alternatives.
• Safe by default. Findings are published as redacted SARIF to the Security tab; raw scanner output never reaches job logs; scanner or infrastructure errors fail closed.

What's included

Surface	Component	Role
CI enforcement	Reusable workflow secret-scan-pulse.yml	Runs NVIDIA's licensed Pulse Secret Scanner (TruffleHog Enterprise) on nv-gha-runners; publishes redacted SARIF to code scanning.
Local advisory	Pre-commit hook secret-scan-trufflehog	Runs open-source TruffleHog on the developer's machine before commit/push.

Enforcement model

Enforcement is controlled by a single failure_policy input, with names aligned to the GitLab secret-scan component for a consistent experience across platforms:

failure_policy	Verified/live secret	Unverified finding
unverified (default)	fail	warn (job stays green)
strict	fail	fail
all	warn	warn

Scanner, Vault, registry, or runner errors always fail the job.

How to consume

CI (reusable workflow) — pin by 40-character commit SHA:

permissions:
  contents: read
  id-token: write
  security-events: write
  actions: read

jobs:
  secret-scan:
    uses: NVIDIA/security-workflows/.github/workflows/secret-scan-pulse.yml@<COMMIT-SHA>
    with:
      runs-on: <your-nv-gha-runner-label>