From 76b7fb59bd8febb2dbc40a716e30408274aa7aca Mon Sep 17 00:00:00 2001 From: haribabug Date: Mon, 28 Sep 2026 10:01:15 +0200 Subject: [PATCH 1/3] chore: add security scanning workflows Copies standardised security scanning config from ROCm/rocm-repo-template. --- .github/dependabot.yml | 17 ++++++ .github/scan_tools_configs/bandit.yml | 18 ++++++ .github/scan_tools_configs/gitleaks.toml | 69 ++++++++++++++++++++++ .github/scan_tools_configs/trivy.yml | 19 ++++++ .github/scan_tools_configs/zizmor.yml | 15 +++++ .github/workflows/pr-security-scan.yml | 38 ++++++++++++ .github/workflows/weekly-security-scan.yml | 39 ++++++++++++ 7 files changed, 215 insertions(+) create mode 100644 .github/scan_tools_configs/bandit.yml create mode 100644 .github/scan_tools_configs/gitleaks.toml create mode 100644 .github/scan_tools_configs/trivy.yml create mode 100644 .github/scan_tools_configs/zizmor.yml create mode 100644 .github/workflows/pr-security-scan.yml create mode 100644 .github/workflows/weekly-security-scan.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 0e0a252eb6e..4ad55e69975 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -16,3 +16,20 @@ updates: - "ci:docs-only" reviewers: - "samjwu" + + # ── GitHub Actions: keep workflow action versions current ────────────────── + - package-ecosystem: "github-actions" + # "/" covers .github/workflows; composite actions keep their own `uses:` + # pins, so .github/actions has to be listed separately to get bumped. + directories: + - "/" + - "/.github/actions/*" + schedule: + interval: "daily" + commit-message: + prefix: "chore" + include: "scope" + groups: + github-actions: + patterns: + - "*" diff --git a/.github/scan_tools_configs/bandit.yml b/.github/scan_tools_configs/bandit.yml new file mode 100644 index 00000000000..aa36e7950a6 --- /dev/null +++ b/.github/scan_tools_configs/bandit.yml @@ -0,0 +1,18 @@ +# bandit minimal configuration +# Reference: https://bandit.readthedocs.io/en/latest/config.html +# +# The default for repositories that ship no bandit config of their own. +# A repository that ships one (`bandit.yaml` or `bandit.yml`) replaces +# this file wholesale rather than layering onto it, so suppressions and +# tuning that belong to a single repository (e.g. `skips: [...]`) belong +# there. What goes here is what should hold for a repository that has +# said nothing. + +exclude_dirs: + - .git + - .venv + - venv + - build + - dist + - node_modules + - __pycache__ diff --git a/.github/scan_tools_configs/gitleaks.toml b/.github/scan_tools_configs/gitleaks.toml new file mode 100644 index 00000000000..98166b4332a --- /dev/null +++ b/.github/scan_tools_configs/gitleaks.toml @@ -0,0 +1,69 @@ +# gitleaks.toml +# Reference: https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml +# +# The default for repositories that ship no gitleaks config of their +# own. A repository that ships one replaces this file wholesale rather +# than layering onto it, so suppressions that belong to a single +# repository belong in that repository's `gitleaks.toml` and +# `.gitleaksignore`, not here. What goes here is what should hold for a +# repository that has said nothing. +# +# Within a scan, the layering is: +# * the `[[allowlists]]` below, applying to every rule. +# * `.gitleaksignore` at the scanned repo's root, carrying one-off +# fingerprint suppressions for historical findings that don't fit +# a structural rule. Keep that file shrinking; move recurring +# patterns up into a config when you see them. + +title = "gitleaks config" + +[extend] +# Inherit gitleaks' built-in ruleset (rotations, AWS, GCP, Slack, ...). +# Setting this to false would mean rolling our own detections, which +# is almost never what you want. +useDefault = true + + + +# Allowlist field-vs-target reference: +# stopwords -> always matched against the SECRET value. +# regexes -> matched against `regexTarget` (default: "secret"). +# regexTarget -> "secret" | "match" | "line". +# Use "match" or "line" when the "tell" is the variable name or +# surrounding syntax, not the value itself. + +[[allowlists]] +# Allowlist by location only where a real first-party secret structurally +# can't live. Dependency lock files qualify: their contents are generated +# from a manifest, and the high-entropy strings they carry are artifact +# digests rather than credentials. Add vendored third-party trees here as +# callers bring them in, one explicit path per entry. +description = "Generated dependency lock files" +paths = [ + '''.*\.lock$''', +] + +[[allowlists]] +description = "Test fixtures using well-known dummy variable names" +# The "tell" here is the variable name on the same line, not the value +# (the value is a random-looking string by design). Match against the +# full rule match (variable + value) so we anchor on the identifier. +regexTarget = "match" +regexes = [ + '''(?i)\bINVALID_TOKEN\s*=''', + '''(?i)\bwrong_secret\s*=''', + '''(?i)\bsecret\s*=''' +] + +[[allowlists]] +description = "Public artifact digests (variable names ending in SHA256/512/MD5)" +# SHA-256/512/MD5 hashes of public artifacts (tarballs, GPG keys, +# mirrored binaries) are not secrets - they're one-way digests used +# for integrity verification. Match by variable name (against the +# whole line) so we don't broadly allowlist every 64-char hex string. +regexTarget = "line" +regexes = [ + '''[A-Z][A-Z0-9_]*SHA256\s*[=:]''', + '''[A-Z][A-Z0-9_]*SHA512\s*[=:]''', + '''[A-Z][A-Z0-9_]*MD5\s*[=:]''', +] diff --git a/.github/scan_tools_configs/trivy.yml b/.github/scan_tools_configs/trivy.yml new file mode 100644 index 00000000000..e51738cdab5 --- /dev/null +++ b/.github/scan_tools_configs/trivy.yml @@ -0,0 +1,19 @@ +# trivy minimal configuration +# Reference: https://trivy.dev/latest/docs/references/configuration/config-file/ +# +# The default for repositories that ship no trivy config of their own. +# A repository that ships one (`trivy.yaml` or `trivy.yml`) replaces this +# file wholesale rather than layering onto it, so suppressions and tuning +# that belong to a single repository (e.g. `vulnerability.ignore-unfixed`, +# or a `.trivyignore`) belong there. What goes here is what should hold +# for a repository that has said nothing. + +scan: + skip-dirs: + - .git + - .venv + - venv + - build + - dist + - node_modules + - __pycache__ diff --git a/.github/scan_tools_configs/zizmor.yml b/.github/scan_tools_configs/zizmor.yml new file mode 100644 index 00000000000..e167e925e00 --- /dev/null +++ b/.github/scan_tools_configs/zizmor.yml @@ -0,0 +1,15 @@ +# zizmor minimal configuration +# Reference: https://docs.zizmor.sh/configuration/ +# +# The default for repositories that ship no zizmor config of their own. +# A repository that ships one (`.github/zizmor.yml`, `.github/zizmor.yaml`, +# `zizmor.yml` or `zizmor.yaml`) replaces this file wholesale rather than +# layering onto it, so suppressions that belong to a single repository +# belong there. What goes here is what should hold for a repository that +# has said nothing. +# +# Per-rule ignore lists and tuning live under `rules:`, as +# `: { ignore: [file.yml:line:col] }`, which keeps a suppression +# reviewable in one place rather than scattered as inline comments +# across workflows. +rules: {} diff --git a/.github/workflows/pr-security-scan.yml b/.github/workflows/pr-security-scan.yml new file mode 100644 index 00000000000..f90588586fa --- /dev/null +++ b/.github/workflows/pr-security-scan.yml @@ -0,0 +1,38 @@ +# Copyright Advanced Micro Devices, Inc. +# SPDX-License-Identifier: MIT +# +# Pre-commit security gate: fast, PR-side security scanners that run on +# every pull request. The security counterpart to `pre-commit.yml`. The +# set of scanners lives in `security-baseline.yml`, so scanners coming +# online are picked up here without touching this file. +# +# Requests human-readable reports only: findings are uploaded as a build +# artifact and printed to the job summary, never to the Security tab, so +# fork PRs (which never receive elevated tokens) behave identically to +# same-repo PRs. See the scheduled counterpart (weekly-security-scan.yml) +# for the SARIF / code-scanning upload. + +name: Security scan (PR) + +on: + pull_request: + # Spelled out the default to avoid confusion. + types: [opened, synchronize, reopened] + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number }} + cancel-in-progress: true + +jobs: + security: + name: Security scan + uses: ROCm/rocm-security-gh/.github/workflows/security-baseline.yml@62c2c4f3effcd47711da28276815c90cb4aa6444 # v1.0.2 + with: + report_formats: human + bandit_config_path: .github/scan_tools_configs/bandit.yml + gitleaks_config_path: .github/scan_tools_configs/gitleaks.toml + trivy_config_path: .github/scan_tools_configs/trivy.yml + zizmor_config_path: .github/scan_tools_configs/zizmor.yml diff --git a/.github/workflows/weekly-security-scan.yml b/.github/workflows/weekly-security-scan.yml new file mode 100644 index 00000000000..0ba132f6021 --- /dev/null +++ b/.github/workflows/weekly-security-scan.yml @@ -0,0 +1,39 @@ +# Copyright Advanced Micro Devices, Inc. +# SPDX-License-Identifier: MIT +# +# Weekly security scan: runs on a fixed cadence and pushes SARIF findings +# to the repository's code-scanning Security tab. Complements +# `pr-security-scan.yml`, which scans only what changed in a PR and +# uploads reviewer-readable artifacts for in-review browsing. +# +# `security-events: write` is granted on the `uses:` job itself, not just +# the top-level `permissions:` block above it, since a `permissions:` +# block (wherever declared) implicitly zeroes out anything it doesn't +# list. + +name: Security scan (Weekly) + +on: + # Run every Saturday at 10:00 UTC. + schedule: + - cron: "0 10 * * 6" + workflow_dispatch: + +permissions: + contents: read + +jobs: + security: + name: Security scan + # Only the job that uploads SARIF gets write access to code scanning. + permissions: + contents: read + security-events: write + uses: ROCm/rocm-security-gh/.github/workflows/security-baseline.yml@62c2c4f3effcd47711da28276815c90cb4aa6444 # v1.0.2 + with: + scan_mode: all + report_formats: sarif + bandit_config_path: .github/scan_tools_configs/bandit.yml + gitleaks_config_path: .github/scan_tools_configs/gitleaks.toml + trivy_config_path: .github/scan_tools_configs/trivy.yml + zizmor_config_path: .github/scan_tools_configs/zizmor.yml From 2c6e00476472c08f7fdb5d6e12c02b429603883a Mon Sep 17 00:00:00 2001 From: Haribabu G Date: Fri, 9 Oct 2026 20:36:28 +0200 Subject: [PATCH 2/3] chore: update dependabot.yml from rocm-repo-template Syncs .github/dependabot.yml with the latest version from ROCm/rocm-repo-template. --- .github/dependabot.yml | 39 ++++++++++++++------------------------- 1 file changed, 14 insertions(+), 25 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 4ad55e69975..477178c9018 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,35 +1,24 @@ -# To get started with Dependabot version updates, you'll need to specify which -# package ecosystems to update and where the package manifests are located. -# Please see the documentation for all configuration options: -# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates +# Copyright Advanced Micro Devices, Inc. +# SPDX-License-Identifier: MIT +# +# Dependabot version updates. See +# https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference version: 2 updates: - - package-ecosystem: "pip" # See documentation for possible values - directory: "/docs/sphinx" # Location of package manifests - open-pull-requests-limit: 10 - schedule: - interval: "daily" - labels: - - "documentation" - - "dependencies" - - "ci:docs-only" - reviewers: - - "samjwu" - - # ── GitHub Actions: keep workflow action versions current ────────────────── - package-ecosystem: "github-actions" # "/" covers .github/workflows; composite actions keep their own `uses:` # pins, so .github/actions has to be listed separately to get bumped. - directories: - - "/" - - "/.github/actions/*" + directory: "/" schedule: interval: "daily" - commit-message: - prefix: "chore" - include: "scope" + # Wait a week before adopting newly released action versions. + cooldown: + default-days: 7 + exclude: + - "ROCm/rocm-security-gh*" groups: + rocm-security-gh: + patterns: ["ROCm/rocm-security-gh*"] github-actions: - patterns: - - "*" + patterns: ["*"] From f6c45208c61c809dc4fd35e0db34a95191436196 Mon Sep 17 00:00:00 2001 From: Haribabu G Date: Wed, 14 Oct 2026 15:26:17 +0200 Subject: [PATCH 3/3] chore: sync security scanning workflows from template Syncs 6 security scanning file(s) with the latest version from ROCm/rocm-repo-template. --- .github/scan_tools_configs/bandit.yml | 22 +++++++------ .github/scan_tools_configs/gitleaks.toml | 36 ++++++++++++---------- .github/scan_tools_configs/trivy.yml | 22 +++++++------ .github/scan_tools_configs/zizmor.yml | 24 +++++++-------- .github/workflows/pr-security-scan.yml | 11 ++++--- .github/workflows/weekly-security-scan.yml | 7 +---- 6 files changed, 65 insertions(+), 57 deletions(-) diff --git a/.github/scan_tools_configs/bandit.yml b/.github/scan_tools_configs/bandit.yml index aa36e7950a6..567e31a2114 100644 --- a/.github/scan_tools_configs/bandit.yml +++ b/.github/scan_tools_configs/bandit.yml @@ -1,17 +1,21 @@ -# bandit minimal configuration +# Copyright Advanced Micro Devices, Inc. +# SPDX-License-Identifier: MIT +# +# bandit configuration # Reference: https://bandit.readthedocs.io/en/latest/config.html +# Local scan: bandit --recursive . --configfile .github/scan_tools_configs/bandit.yml +# +# Bandit configuration for this repository's security scans. # -# The default for repositories that ship no bandit config of their own. -# A repository that ships one (`bandit.yaml` or `bandit.yml`) replaces -# this file wholesale rather than layering onto it, so suppressions and -# tuning that belong to a single repository (e.g. `skips: [...]`) belong -# there. What goes here is what should hold for a repository that has -# said nothing. +# This file defines the complete scanner policy; +# Keep repository-specific suppressions and tuning here. +# Environment and generated-output exclusions support local scans; these +# paths are absent from clean CI checkouts. exclude_dirs: - .git - - .venv - - venv + - .venv* + - venv* - build - dist - node_modules diff --git a/.github/scan_tools_configs/gitleaks.toml b/.github/scan_tools_configs/gitleaks.toml index 98166b4332a..f56e42845da 100644 --- a/.github/scan_tools_configs/gitleaks.toml +++ b/.github/scan_tools_configs/gitleaks.toml @@ -1,19 +1,20 @@ +# Copyright Advanced Micro Devices, Inc. +# SPDX-License-Identifier: MIT +# # gitleaks.toml # Reference: https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml +# Local scan: gitleaks detect --source . --config .github/scan_tools_configs/gitleaks.toml +# +# Gitleaks configuration for this repository's security scans. +# +# This file defines the repository's complete Gitleaks policy. Recurring +# exclusions belong in this file. # -# The default for repositories that ship no gitleaks config of their -# own. A repository that ships one replaces this file wholesale rather -# than layering onto it, so suppressions that belong to a single -# repository belong in that repository's `gitleaks.toml` and -# `.gitleaksignore`, not here. What goes here is what should hold for a -# repository that has said nothing. +# The `[extend]` section inherits Gitleaks' built-in rules, and the +# `[[allowlists]]` below apply to every rule. # -# Within a scan, the layering is: -# * the `[[allowlists]]` below, applying to every rule. -# * `.gitleaksignore` at the scanned repo's root, carrying one-off -# fingerprint suppressions for historical findings that don't fit -# a structural rule. Keep that file shrinking; move recurring -# patterns up into a config when you see them. +# Use `.gitleaksignore` for one-off finding fingerprints. Add recurring path +# or regex exclusions to `[[allowlists]]` in this file. title = "gitleaks config" @@ -52,15 +53,16 @@ regexTarget = "match" regexes = [ '''(?i)\bINVALID_TOKEN\s*=''', '''(?i)\bwrong_secret\s*=''', - '''(?i)\bsecret\s*=''' + # Explicit test-only secret identifiers + '''(?i)\btest_secret\s*=''', + '''(?i)\bdummy_secret\s*=''', + '''(?i)\bfake_secret\s*=''', + '''(?i)\bexample_secret\s*=''' ] [[allowlists]] description = "Public artifact digests (variable names ending in SHA256/512/MD5)" -# SHA-256/512/MD5 hashes of public artifacts (tarballs, GPG keys, -# mirrored binaries) are not secrets - they're one-way digests used -# for integrity verification. Match by variable name (against the -# whole line) so we don't broadly allowlist every 64-char hex string. +# SHA-256/512/MD5 hashes of public artifacts are not secrets. regexTarget = "line" regexes = [ '''[A-Z][A-Z0-9_]*SHA256\s*[=:]''', diff --git a/.github/scan_tools_configs/trivy.yml b/.github/scan_tools_configs/trivy.yml index e51738cdab5..c7ce17413a6 100644 --- a/.github/scan_tools_configs/trivy.yml +++ b/.github/scan_tools_configs/trivy.yml @@ -1,18 +1,22 @@ -# trivy minimal configuration +# Copyright Advanced Micro Devices, Inc. +# SPDX-License-Identifier: MIT +# +# trivy configuration # Reference: https://trivy.dev/latest/docs/references/configuration/config-file/ +# Local scan: trivy fs --config .github/scan_tools_configs/trivy.yml . +# +# Trivy configuration for this repository's security scans. # -# The default for repositories that ship no trivy config of their own. -# A repository that ships one (`trivy.yaml` or `trivy.yml`) replaces this -# file wholesale rather than layering onto it, so suppressions and tuning -# that belong to a single repository (e.g. `vulnerability.ignore-unfixed`, -# or a `.trivyignore`) belong there. What goes here is what should hold -# for a repository that has said nothing. +# This file defines the complete scanner policy; +# Keep repository-specific suppressions and tuning here. +# Environment and generated-output exclusions support local scans; these +# paths are absent from clean CI checkouts. scan: skip-dirs: - .git - - .venv - - venv + - .venv* + - venv* - build - dist - node_modules diff --git a/.github/scan_tools_configs/zizmor.yml b/.github/scan_tools_configs/zizmor.yml index e167e925e00..6135169bf31 100644 --- a/.github/scan_tools_configs/zizmor.yml +++ b/.github/scan_tools_configs/zizmor.yml @@ -1,15 +1,15 @@ -# zizmor minimal configuration +# Copyright Advanced Micro Devices, Inc. +# SPDX-License-Identifier: MIT +# +# zizmor configuration # Reference: https://docs.zizmor.sh/configuration/ +# Local scan: zizmor --config .github/scan_tools_configs/zizmor.yml . +# +# Zizmor configuration for this repository's security scans. +# +# This file defines the complete scanner policy; +# Keep repository-specific suppressions and tuning here. # -# The default for repositories that ship no zizmor config of their own. -# A repository that ships one (`.github/zizmor.yml`, `.github/zizmor.yaml`, -# `zizmor.yml` or `zizmor.yaml`) replaces this file wholesale rather than -# layering onto it, so suppressions that belong to a single repository -# belong there. What goes here is what should hold for a repository that -# has said nothing. -# -# Per-rule ignore lists and tuning live under `rules:`, as -# `: { ignore: [file.yml:line:col] }`, which keeps a suppression -# reviewable in one place rather than scattered as inline comments -# across workflows. +# Add rule-specific settings and suppressions under `rules:`. + rules: {} diff --git a/.github/workflows/pr-security-scan.yml b/.github/workflows/pr-security-scan.yml index f90588586fa..4aa71aaa156 100644 --- a/.github/workflows/pr-security-scan.yml +++ b/.github/workflows/pr-security-scan.yml @@ -2,9 +2,8 @@ # SPDX-License-Identifier: MIT # # Pre-commit security gate: fast, PR-side security scanners that run on -# every pull request. The security counterpart to `pre-commit.yml`. The -# set of scanners lives in `security-baseline.yml`, so scanners coming -# online are picked up here without touching this file. +# every pull request. Scanner selection and policy are defined by the pinned +# ROCm/rocm-security-gh `security-baseline.yml` reusable workflow. # # Requests human-readable reports only: findings are uploaded as a build # artifact and printed to the job summary, never to the Security tab, so @@ -29,7 +28,11 @@ concurrency: jobs: security: name: Security scan - uses: ROCm/rocm-security-gh/.github/workflows/security-baseline.yml@62c2c4f3effcd47711da28276815c90cb4aa6444 # v1.0.2 + permissions: + actions: read + contents: read + pull-requests: write + uses: ROCm/rocm-security-gh/.github/workflows/security-baseline.yml@228e62369c5d8b677215f8a112ea0c8e8119c58f # v1.0.6 with: report_formats: human bandit_config_path: .github/scan_tools_configs/bandit.yml diff --git a/.github/workflows/weekly-security-scan.yml b/.github/workflows/weekly-security-scan.yml index 0ba132f6021..300cc312d32 100644 --- a/.github/workflows/weekly-security-scan.yml +++ b/.github/workflows/weekly-security-scan.yml @@ -5,11 +5,6 @@ # to the repository's code-scanning Security tab. Complements # `pr-security-scan.yml`, which scans only what changed in a PR and # uploads reviewer-readable artifacts for in-review browsing. -# -# `security-events: write` is granted on the `uses:` job itself, not just -# the top-level `permissions:` block above it, since a `permissions:` -# block (wherever declared) implicitly zeroes out anything it doesn't -# list. name: Security scan (Weekly) @@ -29,7 +24,7 @@ jobs: permissions: contents: read security-events: write - uses: ROCm/rocm-security-gh/.github/workflows/security-baseline.yml@62c2c4f3effcd47711da28276815c90cb4aa6444 # v1.0.2 + uses: ROCm/rocm-security-gh/.github/workflows/security-baseline.yml@228e62369c5d8b677215f8a112ea0c8e8119c58f # v1.0.6 with: scan_mode: all report_formats: sarif