From 0f2d923e0b8af33dd254b98fda57d38b1ba834c0 Mon Sep 17 00:00:00 2001 From: Haribabu G Date: Wed, 14 Oct 2026 17:37:29 +0200 Subject: [PATCH 1/2] chore: update security scanning workflows Syncs 7 security scanning file(s) with the latest version from ROCm/rocm-repo-template. --- .github/dependabot.yml | 32 ++++++---- .github/scan_tools_configs/bandit.yml | 22 +++++++ .github/scan_tools_configs/gitleaks.toml | 71 ++++++++++++++++++++++ .github/scan_tools_configs/trivy.yml | 23 +++++++ .github/scan_tools_configs/zizmor.yml | 15 +++++ .github/workflows/pr-security-scan.yml | 41 +++++++++++++ .github/workflows/weekly-security-scan.yml | 34 +++++++++++ 7 files changed, 225 insertions(+), 13 deletions(-) create mode 100644 .github/scan_tools_configs/bandit.yml create mode 100644 .github/scan_tools_configs/gitleaks.toml create mode 100644 .github/scan_tools_configs/trivy.yml create mode 100644 .github/scan_tools_configs/zizmor.yml create mode 100644 .github/workflows/pr-security-scan.yml create mode 100644 .github/workflows/weekly-security-scan.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 0e0a252e..477178c9 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,18 +1,24 @@ -# To get started with Dependabot version updates, you'll need to specify which -# package ecosystems to update and where the package manifests are located. -# Please see the documentation for all configuration options: -# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates +# Copyright Advanced Micro Devices, Inc. +# SPDX-License-Identifier: MIT +# +# Dependabot version updates. See +# https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference version: 2 updates: - - package-ecosystem: "pip" # See documentation for possible values - directory: "/docs/sphinx" # Location of package manifests - open-pull-requests-limit: 10 + - package-ecosystem: "github-actions" + # "/" covers .github/workflows; composite actions keep their own `uses:` + # pins, so .github/actions has to be listed separately to get bumped. + directory: "/" schedule: interval: "daily" - labels: - - "documentation" - - "dependencies" - - "ci:docs-only" - reviewers: - - "samjwu" + # Wait a week before adopting newly released action versions. + cooldown: + default-days: 7 + exclude: + - "ROCm/rocm-security-gh*" + groups: + rocm-security-gh: + patterns: ["ROCm/rocm-security-gh*"] + github-actions: + patterns: ["*"] diff --git a/.github/scan_tools_configs/bandit.yml b/.github/scan_tools_configs/bandit.yml new file mode 100644 index 00000000..567e31a2 --- /dev/null +++ b/.github/scan_tools_configs/bandit.yml @@ -0,0 +1,22 @@ +# Copyright Advanced Micro Devices, Inc. +# SPDX-License-Identifier: MIT +# +# bandit configuration +# Reference: https://bandit.readthedocs.io/en/latest/config.html +# Local scan: bandit --recursive . --configfile .github/scan_tools_configs/bandit.yml +# +# Bandit configuration for this repository's security scans. +# +# This file defines the complete scanner policy; +# Keep repository-specific suppressions and tuning here. + +# Environment and generated-output exclusions support local scans; these +# paths are absent from clean CI checkouts. +exclude_dirs: + - .git + - .venv* + - venv* + - build + - dist + - node_modules + - __pycache__ diff --git a/.github/scan_tools_configs/gitleaks.toml b/.github/scan_tools_configs/gitleaks.toml new file mode 100644 index 00000000..f56e4284 --- /dev/null +++ b/.github/scan_tools_configs/gitleaks.toml @@ -0,0 +1,71 @@ +# Copyright Advanced Micro Devices, Inc. +# SPDX-License-Identifier: MIT +# +# gitleaks.toml +# Reference: https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml +# Local scan: gitleaks detect --source . --config .github/scan_tools_configs/gitleaks.toml +# +# Gitleaks configuration for this repository's security scans. +# +# This file defines the repository's complete Gitleaks policy. Recurring +# exclusions belong in this file. +# +# The `[extend]` section inherits Gitleaks' built-in rules, and the +# `[[allowlists]]` below apply to every rule. +# +# Use `.gitleaksignore` for one-off finding fingerprints. Add recurring path +# or regex exclusions to `[[allowlists]]` in this file. + +title = "gitleaks config" + +[extend] +# Inherit gitleaks' built-in ruleset (rotations, AWS, GCP, Slack, ...). +# Setting this to false would mean rolling our own detections, which +# is almost never what you want. +useDefault = true + + + +# Allowlist field-vs-target reference: +# stopwords -> always matched against the SECRET value. +# regexes -> matched against `regexTarget` (default: "secret"). +# regexTarget -> "secret" | "match" | "line". +# Use "match" or "line" when the "tell" is the variable name or +# surrounding syntax, not the value itself. + +[[allowlists]] +# Allowlist by location only where a real first-party secret structurally +# can't live. Dependency lock files qualify: their contents are generated +# from a manifest, and the high-entropy strings they carry are artifact +# digests rather than credentials. Add vendored third-party trees here as +# callers bring them in, one explicit path per entry. +description = "Generated dependency lock files" +paths = [ + '''.*\.lock$''', +] + +[[allowlists]] +description = "Test fixtures using well-known dummy variable names" +# The "tell" here is the variable name on the same line, not the value +# (the value is a random-looking string by design). Match against the +# full rule match (variable + value) so we anchor on the identifier. +regexTarget = "match" +regexes = [ + '''(?i)\bINVALID_TOKEN\s*=''', + '''(?i)\bwrong_secret\s*=''', + # Explicit test-only secret identifiers + '''(?i)\btest_secret\s*=''', + '''(?i)\bdummy_secret\s*=''', + '''(?i)\bfake_secret\s*=''', + '''(?i)\bexample_secret\s*=''' +] + +[[allowlists]] +description = "Public artifact digests (variable names ending in SHA256/512/MD5)" +# SHA-256/512/MD5 hashes of public artifacts are not secrets. +regexTarget = "line" +regexes = [ + '''[A-Z][A-Z0-9_]*SHA256\s*[=:]''', + '''[A-Z][A-Z0-9_]*SHA512\s*[=:]''', + '''[A-Z][A-Z0-9_]*MD5\s*[=:]''', +] diff --git a/.github/scan_tools_configs/trivy.yml b/.github/scan_tools_configs/trivy.yml new file mode 100644 index 00000000..c7ce1741 --- /dev/null +++ b/.github/scan_tools_configs/trivy.yml @@ -0,0 +1,23 @@ +# Copyright Advanced Micro Devices, Inc. +# SPDX-License-Identifier: MIT +# +# trivy configuration +# Reference: https://trivy.dev/latest/docs/references/configuration/config-file/ +# Local scan: trivy fs --config .github/scan_tools_configs/trivy.yml . +# +# Trivy configuration for this repository's security scans. +# +# This file defines the complete scanner policy; +# Keep repository-specific suppressions and tuning here. + +# Environment and generated-output exclusions support local scans; these +# paths are absent from clean CI checkouts. +scan: + skip-dirs: + - .git + - .venv* + - venv* + - build + - dist + - node_modules + - __pycache__ diff --git a/.github/scan_tools_configs/zizmor.yml b/.github/scan_tools_configs/zizmor.yml new file mode 100644 index 00000000..6135169b --- /dev/null +++ b/.github/scan_tools_configs/zizmor.yml @@ -0,0 +1,15 @@ +# Copyright Advanced Micro Devices, Inc. +# SPDX-License-Identifier: MIT +# +# zizmor configuration +# Reference: https://docs.zizmor.sh/configuration/ +# Local scan: zizmor --config .github/scan_tools_configs/zizmor.yml . +# +# Zizmor configuration for this repository's security scans. +# +# This file defines the complete scanner policy; +# Keep repository-specific suppressions and tuning here. +# +# Add rule-specific settings and suppressions under `rules:`. + +rules: {} diff --git a/.github/workflows/pr-security-scan.yml b/.github/workflows/pr-security-scan.yml new file mode 100644 index 00000000..4aa71aaa --- /dev/null +++ b/.github/workflows/pr-security-scan.yml @@ -0,0 +1,41 @@ +# Copyright Advanced Micro Devices, Inc. +# SPDX-License-Identifier: MIT +# +# Pre-commit security gate: fast, PR-side security scanners that run on +# every pull request. Scanner selection and policy are defined by the pinned +# ROCm/rocm-security-gh `security-baseline.yml` reusable workflow. +# +# Requests human-readable reports only: findings are uploaded as a build +# artifact and printed to the job summary, never to the Security tab, so +# fork PRs (which never receive elevated tokens) behave identically to +# same-repo PRs. See the scheduled counterpart (weekly-security-scan.yml) +# for the SARIF / code-scanning upload. + +name: Security scan (PR) + +on: + pull_request: + # Spelled out the default to avoid confusion. + types: [opened, synchronize, reopened] + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number }} + cancel-in-progress: true + +jobs: + security: + name: Security scan + permissions: + actions: read + contents: read + pull-requests: write + uses: ROCm/rocm-security-gh/.github/workflows/security-baseline.yml@228e62369c5d8b677215f8a112ea0c8e8119c58f # v1.0.6 + with: + report_formats: human + bandit_config_path: .github/scan_tools_configs/bandit.yml + gitleaks_config_path: .github/scan_tools_configs/gitleaks.toml + trivy_config_path: .github/scan_tools_configs/trivy.yml + zizmor_config_path: .github/scan_tools_configs/zizmor.yml diff --git a/.github/workflows/weekly-security-scan.yml b/.github/workflows/weekly-security-scan.yml new file mode 100644 index 00000000..300cc312 --- /dev/null +++ b/.github/workflows/weekly-security-scan.yml @@ -0,0 +1,34 @@ +# Copyright Advanced Micro Devices, Inc. +# SPDX-License-Identifier: MIT +# +# Weekly security scan: runs on a fixed cadence and pushes SARIF findings +# to the repository's code-scanning Security tab. Complements +# `pr-security-scan.yml`, which scans only what changed in a PR and +# uploads reviewer-readable artifacts for in-review browsing. + +name: Security scan (Weekly) + +on: + # Run every Saturday at 10:00 UTC. + schedule: + - cron: "0 10 * * 6" + workflow_dispatch: + +permissions: + contents: read + +jobs: + security: + name: Security scan + # Only the job that uploads SARIF gets write access to code scanning. + permissions: + contents: read + security-events: write + uses: ROCm/rocm-security-gh/.github/workflows/security-baseline.yml@228e62369c5d8b677215f8a112ea0c8e8119c58f # v1.0.6 + with: + scan_mode: all + report_formats: sarif + bandit_config_path: .github/scan_tools_configs/bandit.yml + gitleaks_config_path: .github/scan_tools_configs/gitleaks.toml + trivy_config_path: .github/scan_tools_configs/trivy.yml + zizmor_config_path: .github/scan_tools_configs/zizmor.yml From 8d79b9b9b4a51a863e4f2abd0d21a8d4b2a86b17 Mon Sep 17 00:00:00 2001 From: Haribabu G Date: Thu, 22 Oct 2026 22:46:08 +0200 Subject: [PATCH 2/2] chore: update security scanning workflows Updates 8 security scanning file(s) to the latest version from ROCm/rocm-repo-template. --- .github/scan_tools_configs/.gitleaksignore | 13 +++++++++++++ .github/scan_tools_configs/.trivyignore | 19 +++++++++++++++++++ .github/scan_tools_configs/bandit.yml | 10 ++++++++++ .github/scan_tools_configs/gitleaks.toml | 15 +++++++++++++-- .github/scan_tools_configs/trivy.yml | 15 +++++++++++++++ .github/scan_tools_configs/zizmor.yml | 20 +++++++++++++++++++- .github/workflows/pr-security-scan.yml | 3 ++- .github/workflows/weekly-security-scan.yml | 3 ++- 8 files changed, 93 insertions(+), 5 deletions(-) create mode 100644 .github/scan_tools_configs/.gitleaksignore create mode 100644 .github/scan_tools_configs/.trivyignore diff --git a/.github/scan_tools_configs/.gitleaksignore b/.github/scan_tools_configs/.gitleaksignore new file mode 100644 index 00000000..1e3cd3c5 --- /dev/null +++ b/.github/scan_tools_configs/.gitleaksignore @@ -0,0 +1,13 @@ +# Copyright Advanced Micro Devices, Inc. +# SPDX-License-Identifier: MIT +# +# Reference: https://github.com/gitleaks/gitleaks#gitleaksignore +# +# One finding fingerprint per line, copied from a gitleaks report +# (`:::`). A line starting with # is a +# comment and suppresses nothing. Remove the leading # to activate an +# example: +# +# 3f2a9c1e...:tests/fixtures/creds.py:generic-api-key:12 +# +# Entries here combine with a .gitleaksignore at the repository root. diff --git a/.github/scan_tools_configs/.trivyignore b/.github/scan_tools_configs/.trivyignore new file mode 100644 index 00000000..26da6acf --- /dev/null +++ b/.github/scan_tools_configs/.trivyignore @@ -0,0 +1,19 @@ +# Copyright Advanced Micro Devices, Inc. +# SPDX-License-Identifier: MIT +# +# Reference: https://trivy.dev/latest/docs/configuration/filtering/#trivyignore +# +# One vulnerability, misconfiguration, or secret rule ID per line. +# A line starting with # is a comment and suppresses nothing. Remove the +# leading # to activate an example: +# +# CVE-2019-14697 exp:2027-01-01 +# AVD-DS-0002 +# generic-unwanted-rule +# +# `exp:YYYY-MM-DD` limits a suppression to that date. After it, trivy +# reports the finding again. +# +# This file sits beside the configured trivy.yml, so the scan uses it. +# A .trivyignore at the repository root applies only when this file is +# absent; the two are never merged. diff --git a/.github/scan_tools_configs/bandit.yml b/.github/scan_tools_configs/bandit.yml index 567e31a2..aa800efe 100644 --- a/.github/scan_tools_configs/bandit.yml +++ b/.github/scan_tools_configs/bandit.yml @@ -9,6 +9,16 @@ # # This file defines the complete scanner policy; # Keep repository-specific suppressions and tuning here. +# +# Bandit has no ignore file. Suppress a finding with: +# +# 1. `# nosec ` on the flagged line: +# subprocess.run(cmd, shell=True) # nosec B602 # cmd is a constant +# +# 2. `skips:` for test IDs disabled across the repository: +# skips: [B101] +# +# 3. `exclude_dirs:` below for paths Bandit should not scan. # Environment and generated-output exclusions support local scans; these # paths are absent from clean CI checkouts. diff --git a/.github/scan_tools_configs/gitleaks.toml b/.github/scan_tools_configs/gitleaks.toml index f56e4284..f50c51eb 100644 --- a/.github/scan_tools_configs/gitleaks.toml +++ b/.github/scan_tools_configs/gitleaks.toml @@ -13,8 +13,19 @@ # The `[extend]` section inherits Gitleaks' built-in rules, and the # `[[allowlists]]` below apply to every rule. # -# Use `.gitleaksignore` for one-off finding fingerprints. Add recurring path -# or regex exclusions to `[[allowlists]]` in this file. +# Ways to suppress a finding, narrowest first: +# +# 1. `gitleaks:allow` on the offending line: +# api_key = "not-a-real-key" # gitleaks:allow +# +# 2. `.gitleaksignore` with one finding fingerprint per line: +# 3f2a9c1e...:tests/fixtures/creds.py:generic-api-key:12 +# Reference: https://github.com/gitleaks/gitleaks#gitleaksignore +# Keep it beside this file (`.github/scan_tools_configs/.gitleaksignore`) +# or at the repository root. When both exist, their entries combine. +# The `.gitleaksignore` here is a commented placeholder. +# +# 3. `[[allowlists]]` below for recurring paths, regexes or stopwords. title = "gitleaks config" diff --git a/.github/scan_tools_configs/trivy.yml b/.github/scan_tools_configs/trivy.yml index c7ce1741..579a2de3 100644 --- a/.github/scan_tools_configs/trivy.yml +++ b/.github/scan_tools_configs/trivy.yml @@ -9,6 +9,21 @@ # # This file defines the complete scanner policy; # Keep repository-specific suppressions and tuning here. +# +# Ways to suppress a finding, narrowest first: +# +# 1. `.trivyignore` -- one vulnerability, misconfiguration or secret rule +# ID per line. Add `exp:YYYY-MM-DD` for a temporary suppression: +# CVE-2019-14697 exp:2027-01-01 +# Reference: https://trivy.dev/latest/docs/configuration/filtering/#trivyignore +# Keep it beside this file (`.github/scan_tools_configs/.trivyignore`) +# or at the repository root. The file beside this config takes +# precedence; the two are never merged. The `.trivyignore` here is +# a commented placeholder. +# +# 2. `scan.skip-dirs` / `scan.skip-files` below -- paths trivy never +# reads, for vendored trees and generated output. Anything found only +# there is not scanned at all, so keep entries narrow. # Environment and generated-output exclusions support local scans; these # paths are absent from clean CI checkouts. diff --git a/.github/scan_tools_configs/zizmor.yml b/.github/scan_tools_configs/zizmor.yml index 6135169b..a27bc978 100644 --- a/.github/scan_tools_configs/zizmor.yml +++ b/.github/scan_tools_configs/zizmor.yml @@ -10,6 +10,24 @@ # This file defines the complete scanner policy; # Keep repository-specific suppressions and tuning here. # +# Zizmor has no ignore file. Suppress a finding with: +# +# 1. An inline comment naming the rule: +# run: | # zizmor: ignore[template-injection] input is validated +# +# 2. `rules..ignore` with `[:[:]]`: +# rules: +# template-injection: +# ignore: +# - safe.yml +# +# 3. `rules..disable: true` to disable a rule repository-wide. +# # Add rule-specific settings and suppressions under `rules:`. -rules: {} +rules: + unpinned-uses: + config: + policies: + # Security owns this workflow and moves the v1 tag. + ROCm/rocm-security-gh/.github/workflows/security-baseline.yml: ref-pin diff --git a/.github/workflows/pr-security-scan.yml b/.github/workflows/pr-security-scan.yml index 4aa71aaa..2ec6d51c 100644 --- a/.github/workflows/pr-security-scan.yml +++ b/.github/workflows/pr-security-scan.yml @@ -32,7 +32,8 @@ jobs: actions: read contents: read pull-requests: write - uses: ROCm/rocm-security-gh/.github/workflows/security-baseline.yml@228e62369c5d8b677215f8a112ea0c8e8119c58f # v1.0.6 + # Trust Security-managed v1 updates to minimize developer update noise. + uses: ROCm/rocm-security-gh/.github/workflows/security-baseline.yml@v1 with: report_formats: human bandit_config_path: .github/scan_tools_configs/bandit.yml diff --git a/.github/workflows/weekly-security-scan.yml b/.github/workflows/weekly-security-scan.yml index 300cc312..013c30b0 100644 --- a/.github/workflows/weekly-security-scan.yml +++ b/.github/workflows/weekly-security-scan.yml @@ -24,7 +24,8 @@ jobs: permissions: contents: read security-events: write - uses: ROCm/rocm-security-gh/.github/workflows/security-baseline.yml@228e62369c5d8b677215f8a112ea0c8e8119c58f # v1.0.6 + # Trust Security-managed v1 updates to minimize developer update noise. + uses: ROCm/rocm-security-gh/.github/workflows/security-baseline.yml@v1 with: scan_mode: all report_formats: sarif