diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 0e0a252e..477178c9 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,18 +1,24 @@ -# To get started with Dependabot version updates, you'll need to specify which -# package ecosystems to update and where the package manifests are located. -# Please see the documentation for all configuration options: -# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates +# Copyright Advanced Micro Devices, Inc. +# SPDX-License-Identifier: MIT +# +# Dependabot version updates. See +# https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference version: 2 updates: - - package-ecosystem: "pip" # See documentation for possible values - directory: "/docs/sphinx" # Location of package manifests - open-pull-requests-limit: 10 + - package-ecosystem: "github-actions" + # "/" covers .github/workflows; composite actions keep their own `uses:` + # pins, so .github/actions has to be listed separately to get bumped. + directory: "/" schedule: interval: "daily" - labels: - - "documentation" - - "dependencies" - - "ci:docs-only" - reviewers: - - "samjwu" + # Wait a week before adopting newly released action versions. + cooldown: + default-days: 7 + exclude: + - "ROCm/rocm-security-gh*" + groups: + rocm-security-gh: + patterns: ["ROCm/rocm-security-gh*"] + github-actions: + patterns: ["*"] diff --git a/.github/scan_tools_configs/.gitleaksignore b/.github/scan_tools_configs/.gitleaksignore new file mode 100644 index 00000000..1e3cd3c5 --- /dev/null +++ b/.github/scan_tools_configs/.gitleaksignore @@ -0,0 +1,13 @@ +# Copyright Advanced Micro Devices, Inc. +# SPDX-License-Identifier: MIT +# +# Reference: https://github.com/gitleaks/gitleaks#gitleaksignore +# +# One finding fingerprint per line, copied from a gitleaks report +# (`:::`). A line starting with # is a +# comment and suppresses nothing. Remove the leading # to activate an +# example: +# +# 3f2a9c1e...:tests/fixtures/creds.py:generic-api-key:12 +# +# Entries here combine with a .gitleaksignore at the repository root. diff --git a/.github/scan_tools_configs/.trivyignore b/.github/scan_tools_configs/.trivyignore new file mode 100644 index 00000000..26da6acf --- /dev/null +++ b/.github/scan_tools_configs/.trivyignore @@ -0,0 +1,19 @@ +# Copyright Advanced Micro Devices, Inc. +# SPDX-License-Identifier: MIT +# +# Reference: https://trivy.dev/latest/docs/configuration/filtering/#trivyignore +# +# One vulnerability, misconfiguration, or secret rule ID per line. +# A line starting with # is a comment and suppresses nothing. Remove the +# leading # to activate an example: +# +# CVE-2019-14697 exp:2027-01-01 +# AVD-DS-0002 +# generic-unwanted-rule +# +# `exp:YYYY-MM-DD` limits a suppression to that date. After it, trivy +# reports the finding again. +# +# This file sits beside the configured trivy.yml, so the scan uses it. +# A .trivyignore at the repository root applies only when this file is +# absent; the two are never merged. diff --git a/.github/scan_tools_configs/bandit.yml b/.github/scan_tools_configs/bandit.yml new file mode 100644 index 00000000..aa800efe --- /dev/null +++ b/.github/scan_tools_configs/bandit.yml @@ -0,0 +1,32 @@ +# Copyright Advanced Micro Devices, Inc. +# SPDX-License-Identifier: MIT +# +# bandit configuration +# Reference: https://bandit.readthedocs.io/en/latest/config.html +# Local scan: bandit --recursive . --configfile .github/scan_tools_configs/bandit.yml +# +# Bandit configuration for this repository's security scans. +# +# This file defines the complete scanner policy; +# Keep repository-specific suppressions and tuning here. +# +# Bandit has no ignore file. Suppress a finding with: +# +# 1. `# nosec ` on the flagged line: +# subprocess.run(cmd, shell=True) # nosec B602 # cmd is a constant +# +# 2. `skips:` for test IDs disabled across the repository: +# skips: [B101] +# +# 3. `exclude_dirs:` below for paths Bandit should not scan. + +# Environment and generated-output exclusions support local scans; these +# paths are absent from clean CI checkouts. +exclude_dirs: + - .git + - .venv* + - venv* + - build + - dist + - node_modules + - __pycache__ diff --git a/.github/scan_tools_configs/gitleaks.toml b/.github/scan_tools_configs/gitleaks.toml new file mode 100644 index 00000000..f50c51eb --- /dev/null +++ b/.github/scan_tools_configs/gitleaks.toml @@ -0,0 +1,82 @@ +# Copyright Advanced Micro Devices, Inc. +# SPDX-License-Identifier: MIT +# +# gitleaks.toml +# Reference: https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml +# Local scan: gitleaks detect --source . --config .github/scan_tools_configs/gitleaks.toml +# +# Gitleaks configuration for this repository's security scans. +# +# This file defines the repository's complete Gitleaks policy. Recurring +# exclusions belong in this file. +# +# The `[extend]` section inherits Gitleaks' built-in rules, and the +# `[[allowlists]]` below apply to every rule. +# +# Ways to suppress a finding, narrowest first: +# +# 1. `gitleaks:allow` on the offending line: +# api_key = "not-a-real-key" # gitleaks:allow +# +# 2. `.gitleaksignore` with one finding fingerprint per line: +# 3f2a9c1e...:tests/fixtures/creds.py:generic-api-key:12 +# Reference: https://github.com/gitleaks/gitleaks#gitleaksignore +# Keep it beside this file (`.github/scan_tools_configs/.gitleaksignore`) +# or at the repository root. When both exist, their entries combine. +# The `.gitleaksignore` here is a commented placeholder. +# +# 3. `[[allowlists]]` below for recurring paths, regexes or stopwords. + +title = "gitleaks config" + +[extend] +# Inherit gitleaks' built-in ruleset (rotations, AWS, GCP, Slack, ...). +# Setting this to false would mean rolling our own detections, which +# is almost never what you want. +useDefault = true + + + +# Allowlist field-vs-target reference: +# stopwords -> always matched against the SECRET value. +# regexes -> matched against `regexTarget` (default: "secret"). +# regexTarget -> "secret" | "match" | "line". +# Use "match" or "line" when the "tell" is the variable name or +# surrounding syntax, not the value itself. + +[[allowlists]] +# Allowlist by location only where a real first-party secret structurally +# can't live. Dependency lock files qualify: their contents are generated +# from a manifest, and the high-entropy strings they carry are artifact +# digests rather than credentials. Add vendored third-party trees here as +# callers bring them in, one explicit path per entry. +description = "Generated dependency lock files" +paths = [ + '''.*\.lock$''', +] + +[[allowlists]] +description = "Test fixtures using well-known dummy variable names" +# The "tell" here is the variable name on the same line, not the value +# (the value is a random-looking string by design). Match against the +# full rule match (variable + value) so we anchor on the identifier. +regexTarget = "match" +regexes = [ + '''(?i)\bINVALID_TOKEN\s*=''', + '''(?i)\bwrong_secret\s*=''', + # Explicit test-only secret identifiers + '''(?i)\btest_secret\s*=''', + '''(?i)\bdummy_secret\s*=''', + '''(?i)\bfake_secret\s*=''', + '''(?i)\bexample_secret\s*=''' +] + +[[allowlists]] +description = "Public artifact digests (variable names ending in SHA256/512/MD5)" +# SHA-256/512/MD5 hashes of public artifacts are not secrets. +regexTarget = "line" +regexes = [ + '''[A-Z][A-Z0-9_]*SHA256\s*[=:]''', + '''[A-Z][A-Z0-9_]*SHA512\s*[=:]''', + '''[A-Z][A-Z0-9_]*MD5\s*[=:]''', +] diff --git a/.github/scan_tools_configs/trivy.yml b/.github/scan_tools_configs/trivy.yml new file mode 100644 index 00000000..579a2de3 --- /dev/null +++ b/.github/scan_tools_configs/trivy.yml @@ -0,0 +1,38 @@ +# Copyright Advanced Micro Devices, Inc. +# SPDX-License-Identifier: MIT +# +# trivy configuration +# Reference: https://trivy.dev/latest/docs/references/configuration/config-file/ +# Local scan: trivy fs --config .github/scan_tools_configs/trivy.yml . +# +# Trivy configuration for this repository's security scans. +# +# This file defines the complete scanner policy; +# Keep repository-specific suppressions and tuning here. +# +# Ways to suppress a finding, narrowest first: +# +# 1. `.trivyignore` -- one vulnerability, misconfiguration or secret rule +# ID per line. Add `exp:YYYY-MM-DD` for a temporary suppression: +# CVE-2019-14697 exp:2027-01-01 +# Reference: https://trivy.dev/latest/docs/configuration/filtering/#trivyignore +# Keep it beside this file (`.github/scan_tools_configs/.trivyignore`) +# or at the repository root. The file beside this config takes +# precedence; the two are never merged. The `.trivyignore` here is +# a commented placeholder. +# +# 2. `scan.skip-dirs` / `scan.skip-files` below -- paths trivy never +# reads, for vendored trees and generated output. Anything found only +# there is not scanned at all, so keep entries narrow. + +# Environment and generated-output exclusions support local scans; these +# paths are absent from clean CI checkouts. +scan: + skip-dirs: + - .git + - .venv* + - venv* + - build + - dist + - node_modules + - __pycache__ diff --git a/.github/scan_tools_configs/zizmor.yml b/.github/scan_tools_configs/zizmor.yml new file mode 100644 index 00000000..a27bc978 --- /dev/null +++ b/.github/scan_tools_configs/zizmor.yml @@ -0,0 +1,33 @@ +# Copyright Advanced Micro Devices, Inc. +# SPDX-License-Identifier: MIT +# +# zizmor configuration +# Reference: https://docs.zizmor.sh/configuration/ +# Local scan: zizmor --config .github/scan_tools_configs/zizmor.yml . +# +# Zizmor configuration for this repository's security scans. +# +# This file defines the complete scanner policy; +# Keep repository-specific suppressions and tuning here. +# +# Zizmor has no ignore file. Suppress a finding with: +# +# 1. An inline comment naming the rule: +# run: | # zizmor: ignore[template-injection] input is validated +# +# 2. `rules..ignore` with `[:[:]]`: +# rules: +# template-injection: +# ignore: +# - safe.yml +# +# 3. `rules..disable: true` to disable a rule repository-wide. +# +# Add rule-specific settings and suppressions under `rules:`. + +rules: + unpinned-uses: + config: + policies: + # Security owns this workflow and moves the v1 tag. + ROCm/rocm-security-gh/.github/workflows/security-baseline.yml: ref-pin diff --git a/.github/workflows/pr-security-scan.yml b/.github/workflows/pr-security-scan.yml new file mode 100644 index 00000000..2ec6d51c --- /dev/null +++ b/.github/workflows/pr-security-scan.yml @@ -0,0 +1,42 @@ +# Copyright Advanced Micro Devices, Inc. +# SPDX-License-Identifier: MIT +# +# Pre-commit security gate: fast, PR-side security scanners that run on +# every pull request. Scanner selection and policy are defined by the pinned +# ROCm/rocm-security-gh `security-baseline.yml` reusable workflow. +# +# Requests human-readable reports only: findings are uploaded as a build +# artifact and printed to the job summary, never to the Security tab, so +# fork PRs (which never receive elevated tokens) behave identically to +# same-repo PRs. See the scheduled counterpart (weekly-security-scan.yml) +# for the SARIF / code-scanning upload. + +name: Security scan (PR) + +on: + pull_request: + # Spelled out the default to avoid confusion. + types: [opened, synchronize, reopened] + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number }} + cancel-in-progress: true + +jobs: + security: + name: Security scan + permissions: + actions: read + contents: read + pull-requests: write + # Trust Security-managed v1 updates to minimize developer update noise. + uses: ROCm/rocm-security-gh/.github/workflows/security-baseline.yml@v1 + with: + report_formats: human + bandit_config_path: .github/scan_tools_configs/bandit.yml + gitleaks_config_path: .github/scan_tools_configs/gitleaks.toml + trivy_config_path: .github/scan_tools_configs/trivy.yml + zizmor_config_path: .github/scan_tools_configs/zizmor.yml diff --git a/.github/workflows/weekly-security-scan.yml b/.github/workflows/weekly-security-scan.yml new file mode 100644 index 00000000..013c30b0 --- /dev/null +++ b/.github/workflows/weekly-security-scan.yml @@ -0,0 +1,35 @@ +# Copyright Advanced Micro Devices, Inc. +# SPDX-License-Identifier: MIT +# +# Weekly security scan: runs on a fixed cadence and pushes SARIF findings +# to the repository's code-scanning Security tab. Complements +# `pr-security-scan.yml`, which scans only what changed in a PR and +# uploads reviewer-readable artifacts for in-review browsing. + +name: Security scan (Weekly) + +on: + # Run every Saturday at 10:00 UTC. + schedule: + - cron: "0 10 * * 6" + workflow_dispatch: + +permissions: + contents: read + +jobs: + security: + name: Security scan + # Only the job that uploads SARIF gets write access to code scanning. + permissions: + contents: read + security-events: write + # Trust Security-managed v1 updates to minimize developer update noise. + uses: ROCm/rocm-security-gh/.github/workflows/security-baseline.yml@v1 + with: + scan_mode: all + report_formats: sarif + bandit_config_path: .github/scan_tools_configs/bandit.yml + gitleaks_config_path: .github/scan_tools_configs/gitleaks.toml + trivy_config_path: .github/scan_tools_configs/trivy.yml + zizmor_config_path: .github/scan_tools_configs/zizmor.yml