v0.4.0 — Per-language CodeQL build modes

CodeQL SAST now resolves a build mode per language instead of applying one value to every matrix leg, so language sets with conflicting requirements work in a single call.
'["go","rust"]' was previously impossible — Go rejects build-mode: none and Rust supports nothing else — and now resolves each leg correctly.
languages entries may also be objects carrying a per-language build-mode or runs-on, which makes swift usable since it requires a macOS runner.
A new resolve job validates the language set before any analysis starts. Additive. Callers passing a plain string array need no change, declared permissions are unchanged, and the analyze job keeps the name CodeQL (<language>) so required status checks continue to match. A new non-required check, Resolve language matrix, appears alongside it.
Full notes: CHANGELOG.md

v0.3.0 — SAST (CodeQL) and the opt-in Security Suite

This release adds the second and third reusable workflows: a generic CodeQL SAST workflow, and a Security Suite that lets a repository consume several scans behind a single pinned reference. The secret-scan-trufflehog pre-commit hook now installs its scanner inside pre-commit's own environment, which removes the shell installer and makes Windows work without Git Bash.

Why this matters

• One pin, several scans. security-suite.yml fans out to the scans a caller enables, in parallel. Onboarding a repository no longer means adding one uses: block per scanner.
• Every scan is opt-in. Scans added in future releases default to off, so a suite consumer never silently starts running a scan it did not ask for.
• SAST available as a customization lever. sast-scan-codeql.yml is for repositories deliberately on CodeQL Advanced setup; the fleet baseline remains GitHub Default setup via org/enterprise Security Configurations.
• The pre-commit hook stopped blocking on test names. Any Python repository with long test_ function names was hitting false positives.

What changed since v0.2.0

Added

• security-suite.yml — runs the scans a caller enables (enable-secret-scan, enable-sast-scan) in parallel behind one pinned reference. Category-prefixed inputs pass runner and policy settings through to each child workflow. A suite call that enables nothing warns instead of failing.
• sast-scan-codeql.yml — matrix-driven CodeQL analysis (languages, build-mode, queries, packs, config-file, runs-on), with every github/codeql-action step pinned by SHA. See the workflow catalogue for the GHAS prerequisites and the Default-setup conflict.

Changed

• secret-scan-trufflehog now installs the SHA-256-pinned TruffleHog release (3.95.9, unchanged) into pre-commit's isolated Python environment instead of a per-user cache. The hooks/trufflehog.sh wrapper is gone.
• secret-scan-pulse.yml no longer uploads SARIF on self-test runs (ci_test_setup: true), so the disposable test fixture stops publishing an alert to the Security tab. Consumer scans are unaffected.

Fixed

• secret-scan-trufflehog no longer fails on pytest function names. A Lob API key is test_ followed by 35 characters, so TruffleHog's Lob detector matched names such as test_gpu_conf_compute_attestation_report and its verifier reported them as verified — the one result class this hook blocks on. Lob is now excluded.

Compatibility

• Drop-in for pre-commit consumers. The hook id, stages, and --results=verified policy are unchanged; only how the binary is obtained changed, plus the new --exclude-detectors=lob. Anything invoking hooks/trufflehog.sh directly must stop — that file no longer exists.
• No breaking workflow change. secret-scan-pulse.yml inputs and its failure_policy model are identical to v0.2.0.
• Suite callers must grant the union of every scan's permissions, including scans they disable. GitHub validates a caller against the permissions the called workflow declares, before evaluating any if:.

Requirements

• Python 3.8+ and network access to github.com when pre-commit first builds the hook environment; later runs are offline.
• Windows no longer requires Git Bash/MSYS for the hook. Verified on Windows, macOS, and Linux (x86_64 and ARM64).

How to upgrade

Bump the pre-commit pin from v0.2.0 to v0.3.0:

repos:
  - repo: https://github.com/NVIDIA/security-workflows
    rev: v0.3.0
    hooks:
      - id: secret-scan-trufflehog

The reusable-workflow uses: pin (by commit SHA) is unaffected by this release.

Pinning policy (unchanged)

• Pre-commit rev: -> release tag (this tag, v0.3.0).
• Workflow uses: -> 40-character commit SHA.

Full detail in CHANGELOG.md. Pre-1.0: interfaces may still change in a minor release while the surfaces stabilize with ProdSec.

v0.2.0 — Self-installing secret-scan pre-commit hook

v0.2.0 — Self-installing secret-scan pre-commit hook

This release makes the secret-scan-trufflehog pre-commit hook install nothing manually. On first use it fetches a pinned, checksum-verified TruffleHog release into a per-user cache and reuses it thereafter — the same "it just works" experience contributors expect from hooks like clang-format. The CI (Pulse) surface is unchanged.

Why this matters

• Zero-setup for contributors. No brew install / curl | sh / PATH juggling — the hook provisions its own pinned scanner on the first commit.
• Cross-platform. Linux, macOS, and Windows (via Git Bash/MSYS), on both amd64 and arm64.
• Supply-chain safe. The binary is downloaded over HTTPS and verified against a per-platform SHA-256 pinned from TruffleHog's cosign-signed checksums.txt; the hook fails closed on any mismatch and never executes an unverified binary.

What changed since v0.1.0

• The secret-scan-trufflehog hook wrapper now self-installs TruffleHog 3.95.9:
  • Downloads the official release archive for the detected OS/arch.
  • Verifies it against a pinned SHA-256 (fail-closed).
  • Caches it under ${XDG_CACHE_HOME:-~/.cache}/nvidia-security-workflows/trufflehog/<version>/ and reuses it offline on subsequent runs.
• Added Windows support (Git Bash/MSYS) alongside Linux and macOS.
• Documentation updated; the previous, incorrect manual-install guidance (pip install trufflehog, which resolves to a deprecated unrelated tool) has been removed.

Compatibility

• Drop-in for existing consumers. The hook id, arguments (--results=verified), stages, and default behavior are unchanged — only how the binary is obtained changed.
• No CI/workflow change. The Pulse reusable workflow (secret-scan-pulse.yml) and its failure_policy model are identical to v0.1.0.

Requirements (new)

• Network access to github.com on the first run per version (subsequent runs are offline).
• curl or wget, tar, and sha256sum/shasum available — standard on Linux/macOS and bundled with Git for Windows.
• Windows contributors must run within a Git Bash/MSYS environment.

How to upgrade

Bump the pre-commit pin from v0.1.0 to v0.2.0 in your .pre-commit-config.yaml:

repos:
  - repo: https://github.com/NVIDIA/security-workflows
    rev: v0.2.0
    hooks:
      - id: secret-scan-trufflehog

The reusable-workflow uses: pin (by commit SHA) is unaffected by this release.

Pinning policy (unchanged)

• Pre-commit rev: -> release tag (this tag, v0.2.0).
• Workflow uses: -> 40-character commit SHA.

Full detail in CHANGELOG.md. Pre-1.0: interfaces may still change in a minor release while the surfaces stabilize with ProdSec.

v0.1.0 — Secret scanning (pilot)

The first release of NVIDIA Security Workflows — the single, centrally maintained source for security-compliance scanning across NVIDIA's GitHub repositories.
This pilot delivers the secret-scanning capability across both the developer and CI surfaces, so a leaked credential is caught locally before commit and enforced server-side before merge.

Why this matters

• One source of truth. Consumers reference a pinned, reviewed workflow instead of copying scanner logic into every repository.
• Defense in depth. A fast local advisory check plus authoritative, fail-closed CI enforcement — complementary layers, not alternatives.
• Safe by default. Findings are published as redacted SARIF to the Security tab; raw scanner output never reaches job logs; scanner or infrastructure errors fail closed.

What's included

Surface	Component	Role
CI enforcement	Reusable workflow secret-scan-pulse.yml	Runs NVIDIA's licensed Pulse Secret Scanner (TruffleHog Enterprise) on nv-gha-runners; publishes redacted SARIF to code scanning.
Local advisory	Pre-commit hook secret-scan-trufflehog	Runs open-source TruffleHog on the developer's machine before commit/push.

Enforcement model

Enforcement is controlled by a single failure_policy input, with names aligned to the GitLab secret-scan component for a consistent experience across platforms:

failure_policy	Verified/live secret	Unverified finding
unverified (default)	fail	warn (job stays green)
strict	fail	fail
all	warn	warn

Scanner, Vault, registry, or runner errors always fail the job.

How to consume

CI (reusable workflow) — pin by 40-character commit SHA:

permissions:
  contents: read
  id-token: write
  security-events: write
  actions: read

jobs:
  secret-scan:
    uses: NVIDIA/security-workflows/.github/workflows/secret-scan-pulse.yml@<COMMIT-SHA>
    with:
      runs-on: <your-nv-gha-runner-label>