v0.3.0 — SAST (CodeQL) and the opt-in Security Suite

This release adds the second and third reusable workflows: a generic CodeQL SAST workflow, and a Security Suite that lets a repository consume several scans behind a single pinned reference. The secret-scan-trufflehog pre-commit hook now installs its scanner inside pre-commit's own environment, which removes the shell installer and makes Windows work without Git Bash.

Why this matters

• One pin, several scans. security-suite.yml fans out to the scans a caller enables, in parallel. Onboarding a repository no longer means adding one uses: block per scanner.
• Every scan is opt-in. Scans added in future releases default to off, so a suite consumer never silently starts running a scan it did not ask for.
• SAST available as a customization lever. sast-scan-codeql.yml is for repositories deliberately on CodeQL Advanced setup; the fleet baseline remains GitHub Default setup via org/enterprise Security Configurations.
• The pre-commit hook stopped blocking on test names. Any Python repository with long test_ function names was hitting false positives.

What changed since v0.2.0

Added

• security-suite.yml — runs the scans a caller enables (enable-secret-scan, enable-sast-scan) in parallel behind one pinned reference. Category-prefixed inputs pass runner and policy settings through to each child workflow. A suite call that enables nothing warns instead of failing.
• sast-scan-codeql.yml — matrix-driven CodeQL analysis (languages, build-mode, queries, packs, config-file, runs-on), with every github/codeql-action step pinned by SHA. See the workflow catalogue for the GHAS prerequisites and the Default-setup conflict.

Changed

• secret-scan-trufflehog now installs the SHA-256-pinned TruffleHog release (3.95.9, unchanged) into pre-commit's isolated Python environment instead of a per-user cache. The hooks/trufflehog.sh wrapper is gone.
• secret-scan-pulse.yml no longer uploads SARIF on self-test runs (ci_test_setup: true), so the disposable test fixture stops publishing an alert to the Security tab. Consumer scans are unaffected.

Fixed

• secret-scan-trufflehog no longer fails on pytest function names. A Lob API key is test_ followed by 35 characters, so TruffleHog's Lob detector matched names such as test_gpu_conf_compute_attestation_report and its verifier reported them as verified — the one result class this hook blocks on. Lob is now excluded.

Compatibility

• Drop-in for pre-commit consumers. The hook id, stages, and --results=verified policy are unchanged; only how the binary is obtained changed, plus the new --exclude-detectors=lob. Anything invoking hooks/trufflehog.sh directly must stop — that file no longer exists.
• No breaking workflow change. secret-scan-pulse.yml inputs and its failure_policy model are identical to v0.2.0.
• Suite callers must grant the union of every scan's permissions, including scans they disable. GitHub validates a caller against the permissions the called workflow declares, before evaluating any if:.

Requirements

• Python 3.8+ and network access to github.com when pre-commit first builds the hook environment; later runs are offline.
• Windows no longer requires Git Bash/MSYS for the hook. Verified on Windows, macOS, and Linux (x86_64 and ARM64).

How to upgrade

Bump the pre-commit pin from v0.2.0 to v0.3.0:

repos:
  - repo: https://github.com/NVIDIA/security-workflows
    rev: v0.3.0
    hooks:
      - id: secret-scan-trufflehog

The reusable-workflow uses: pin (by commit SHA) is unaffected by this release.

Pinning policy (unchanged)

• Pre-commit rev: -> release tag (this tag, v0.3.0).
• Workflow uses: -> 40-character commit SHA.

Full detail in CHANGELOG.md. Pre-1.0: interfaces may still change in a minor release while the surfaces stabilize with ProdSec.