chore: update security scanning workflows

.github/dependabot.yml

@@ -1,18 +1,24 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+# Copyright Advanced Micro Devices, Inc.
+# SPDX-License-Identifier: MIT
+#
+# Dependabot version updates. See
+# https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference
 
 version: 2
 updates:
-  - package-ecosystem: "pip" # See documentation for possible values
-    directory: "/docs/sphinx" # Location of package manifests
-    open-pull-requests-limit: 10
+  - package-ecosystem: "github-actions"
+    # "/" covers .github/workflows; composite actions keep their own `uses:`
+    # pins, so .github/actions has to be listed separately to get bumped.
+    directory: "/"
     schedule:
       interval: "daily"
-    labels:
-      - "documentation"
-      - "dependencies"
-      - "ci:docs-only"
-    reviewers:
-      - "samjwu"
+      # Wait a week before adopting newly released action versions.
+    cooldown:
+      default-days: 7
+      exclude:
+        - "ROCm/rocm-security-gh*"
+    groups:
+      rocm-security-gh:
+        patterns: ["ROCm/rocm-security-gh*"]
+      github-actions:
+        patterns: ["*"]

.github/scan_tools_configs/.gitleaksignore

@@ -0,0 +1,13 @@
+# Copyright Advanced Micro Devices, Inc.
+# SPDX-License-Identifier: MIT
+#
+# Reference: https://github.com/gitleaks/gitleaks#gitleaksignore
+#
+# One finding fingerprint per line, copied from a gitleaks report
+# (`<commit>:<path>:<rule-id>:<line>`). A line starting with # is a
+# comment and suppresses nothing. Remove the leading # to activate an
+# example:
+#
+#   3f2a9c1e...:tests/fixtures/creds.py:generic-api-key:12
+#
+# Entries here combine with a .gitleaksignore at the repository root.

.github/scan_tools_configs/.trivyignore

@@ -0,0 +1,19 @@
+# Copyright Advanced Micro Devices, Inc.
+# SPDX-License-Identifier: MIT
+#
+# Reference: https://trivy.dev/latest/docs/configuration/filtering/#trivyignore
+#
+# One vulnerability, misconfiguration, or secret rule ID per line.
+# A line starting with # is a comment and suppresses nothing. Remove the
+# leading # to activate an example:
+#
+#   CVE-2019-14697 exp:2027-01-01
+#   AVD-DS-0002
+#   generic-unwanted-rule
+#
+# `exp:YYYY-MM-DD` limits a suppression to that date. After it, trivy
+# reports the finding again.
+#
+# This file sits beside the configured trivy.yml, so the scan uses it.
+# A .trivyignore at the repository root applies only when this file is
+# absent; the two are never merged.

.github/scan_tools_configs/bandit.yml

@@ -0,0 +1,32 @@
+# Copyright Advanced Micro Devices, Inc.
+# SPDX-License-Identifier: MIT
+#
+# bandit configuration
+# Reference: https://bandit.readthedocs.io/en/latest/config.html
+# Local scan: bandit --recursive . --configfile .github/scan_tools_configs/bandit.yml
+#
+# Bandit configuration for this repository's security scans.
+#
+# This file defines the complete scanner policy;
+# Keep repository-specific suppressions and tuning here.
+#
+# Bandit has no ignore file. Suppress a finding with:
+#
+#   1. `# nosec <test ID>` on the flagged line:
+#          subprocess.run(cmd, shell=True)  # nosec B602 # cmd is a constant
+#
+#   2. `skips:` for test IDs disabled across the repository:
+#          skips: [B101]
+#
+#   3. `exclude_dirs:` below for paths Bandit should not scan.
+
+# Environment and generated-output exclusions support local scans; these
+# paths are absent from clean CI checkouts.
+exclude_dirs:
+  - .git
+  - .venv*
+  - venv*
+  - build
+  - dist
+  - node_modules
+  - __pycache__

.github/scan_tools_configs/gitleaks.toml

@@ -0,0 +1,82 @@
+# Copyright Advanced Micro Devices, Inc.
+# SPDX-License-Identifier: MIT
+#
+# gitleaks.toml
+# Reference: https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml
+# Local scan: gitleaks detect --source . --config .github/scan_tools_configs/gitleaks.toml
+#
+# Gitleaks configuration for this repository's security scans.
+#
+# This file defines the repository's complete Gitleaks policy. Recurring
+# exclusions belong in this file.
+#
+# The `[extend]` section inherits Gitleaks' built-in rules, and the
+# `[[allowlists]]` below apply to every rule.
+#
+# Ways to suppress a finding, narrowest first:
+#
+#   1. `gitleaks:allow` on the offending line:
+#          api_key = "not-a-real-key"  # gitleaks:allow
+#
+#   2. `.gitleaksignore` with one finding fingerprint per line:
+#          3f2a9c1e...:tests/fixtures/creds.py:generic-api-key:12
+#      Reference: https://github.com/gitleaks/gitleaks#gitleaksignore
+#      Keep it beside this file (`.github/scan_tools_configs/.gitleaksignore`)
+#      or at the repository root. When both exist, their entries combine.
+#      The `.gitleaksignore` here is a commented placeholder.
+#
+#   3. `[[allowlists]]` below for recurring paths, regexes or stopwords.
+
+title = "gitleaks config"
+
+[extend]
+# Inherit gitleaks' built-in ruleset (rotations, AWS, GCP, Slack, ...).
+# Setting this to false would mean rolling our own detections, which
+# is almost never what you want.
+useDefault = true
+
+
+
+# Allowlist field-vs-target reference:
+#   stopwords         -> always matched against the SECRET value.
+#   regexes           -> matched against `regexTarget` (default: "secret").
+#   regexTarget       -> "secret" | "match" | "line".
+# Use "match" or "line" when the "tell" is the variable name or
+# surrounding syntax, not the value itself.
+
+[[allowlists]]
+# Allowlist by location only where a real first-party secret structurally
+# can't live. Dependency lock files qualify: their contents are generated
+# from a manifest, and the high-entropy strings they carry are artifact
+# digests rather than credentials. Add vendored third-party trees here as
+# callers bring them in, one explicit path per entry.
+description = "Generated dependency lock files"
+paths = [
+  '''.*\.lock$''',
+]
+
+[[allowlists]]
+description = "Test fixtures using well-known dummy variable names"
+# The "tell" here is the variable name on the same line, not the value
+# (the value is a random-looking string by design). Match against the
+# full rule match (variable + value) so we anchor on the identifier.
+regexTarget = "match"
+regexes = [
+  '''(?i)\bINVALID_TOKEN\s*=''',
+  '''(?i)\bwrong_secret\s*=''',
+  # Explicit test-only secret identifiers
+  '''(?i)\btest_secret\s*=''',
+  '''(?i)\bdummy_secret\s*=''',
+  '''(?i)\bfake_secret\s*=''',
+  '''(?i)\bexample_secret\s*='''
+]
+
+[[allowlists]]
+description = "Public artifact digests (variable names ending in SHA256/512/MD5)"
+# SHA-256/512/MD5 hashes of public artifacts are not secrets.
+regexTarget = "line"
+regexes = [
+  '''[A-Z][A-Z0-9_]*SHA256\s*[=:]''',
+  '''[A-Z][A-Z0-9_]*SHA512\s*[=:]''',
+  '''[A-Z][A-Z0-9_]*MD5\s*[=:]''',
+]

.github/scan_tools_configs/trivy.yml

@@ -0,0 +1,38 @@
+# Copyright Advanced Micro Devices, Inc.
+# SPDX-License-Identifier: MIT
+#
+# trivy configuration
+# Reference: https://trivy.dev/latest/docs/references/configuration/config-file/
+# Local scan: trivy fs --config .github/scan_tools_configs/trivy.yml .
+#
+# Trivy configuration for this repository's security scans.
+#
+# This file defines the complete scanner policy;
+# Keep repository-specific suppressions and tuning here.
+#
+# Ways to suppress a finding, narrowest first:
+#
+#   1. `.trivyignore` -- one vulnerability, misconfiguration or secret rule
+#      ID per line. Add `exp:YYYY-MM-DD` for a temporary suppression:
+#          CVE-2019-14697 exp:2027-01-01
+#      Reference: https://trivy.dev/latest/docs/configuration/filtering/#trivyignore
+#      Keep it beside this file (`.github/scan_tools_configs/.trivyignore`)
+#      or at the repository root. The file beside this config takes
+#      precedence; the two are never merged. The `.trivyignore` here is
+#      a commented placeholder.
+#
+#   2. `scan.skip-dirs` / `scan.skip-files` below -- paths trivy never
+#      reads, for vendored trees and generated output. Anything found only
+#      there is not scanned at all, so keep entries narrow.
+
+# Environment and generated-output exclusions support local scans; these
+# paths are absent from clean CI checkouts.
+scan:
+  skip-dirs:
+    - .git
+    - .venv*
+    - venv*
+    - build
+    - dist
+    - node_modules
+    - __pycache__

.github/scan_tools_configs/zizmor.yml

@@ -0,0 +1,33 @@
+# Copyright Advanced Micro Devices, Inc.
+# SPDX-License-Identifier: MIT
+#
+# zizmor configuration
+# Reference: https://docs.zizmor.sh/configuration/
+# Local scan: zizmor --config .github/scan_tools_configs/zizmor.yml .
+#
+# Zizmor configuration for this repository's security scans.
+#
+# This file defines the complete scanner policy;
+# Keep repository-specific suppressions and tuning here.
+#
+# Zizmor has no ignore file. Suppress a finding with:
+#
+#   1. An inline comment naming the rule:
+#          run: | # zizmor: ignore[template-injection] input is validated
+#
+#   2. `rules.<rule-id>.ignore` with `<file>[:<line>[:<col>]]`:
+#          rules:
+#            template-injection:
+#              ignore:
+#                - safe.yml
+#
+#   3. `rules.<rule-id>.disable: true` to disable a rule repository-wide.
+#
+# Add rule-specific settings and suppressions under `rules:`.
+
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        # Security owns this workflow and moves the v1 tag.
+        ROCm/rocm-security-gh/.github/workflows/security-baseline.yml: ref-pin

.github/workflows/pr-security-scan.yml

@@ -0,0 +1,42 @@
+# Copyright Advanced Micro Devices, Inc.
+# SPDX-License-Identifier: MIT
+#
+# Pre-commit security gate: fast, PR-side security scanners that run on
+# every pull request. Scanner selection and policy are defined by the pinned
+# ROCm/rocm-security-gh `security-baseline.yml` reusable workflow.
+#
+# Requests human-readable reports only: findings are uploaded as a build
+# artifact and printed to the job summary, never to the Security tab, so
+# fork PRs (which never receive elevated tokens) behave identically to
+# same-repo PRs. See the scheduled counterpart (weekly-security-scan.yml)
+# for the SARIF / code-scanning upload.
+
+name: Security scan (PR)
+
+on:
+  pull_request:
+    # Spelled out the default to avoid confusion.
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  security:
+    name: Security scan
+    permissions:
+      actions: read
+      contents: read
+      pull-requests: write
+    # Trust Security-managed v1 updates to minimize developer update noise.
+    uses: ROCm/rocm-security-gh/.github/workflows/security-baseline.yml@v1
+    with:
+      report_formats: human
+      bandit_config_path: .github/scan_tools_configs/bandit.yml
+      gitleaks_config_path: .github/scan_tools_configs/gitleaks.toml
+      trivy_config_path: .github/scan_tools_configs/trivy.yml
+      zizmor_config_path: .github/scan_tools_configs/zizmor.yml

.github/workflows/weekly-security-scan.yml

@@ -0,0 +1,35 @@
+# Copyright Advanced Micro Devices, Inc.
+# SPDX-License-Identifier: MIT
+#
+# Weekly security scan: runs on a fixed cadence and pushes SARIF findings
+# to the repository's code-scanning Security tab. Complements
+# `pr-security-scan.yml`, which scans only what changed in a PR and
+# uploads reviewer-readable artifacts for in-review browsing.
+
+name: Security scan (Weekly)
+
+on:
+  # Run every Saturday at 10:00 UTC.
+  schedule:
+    - cron: "0 10 * * 6"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  security:
+    name: Security scan
+    # Only the job that uploads SARIF gets write access to code scanning.
+    permissions:
+      contents: read
+      security-events: write
+    # Trust Security-managed v1 updates to minimize developer update noise.
+    uses: ROCm/rocm-security-gh/.github/workflows/security-baseline.yml@v1
+    with:
+      scan_mode: all
+      report_formats: sarif
+      bandit_config_path: .github/scan_tools_configs/bandit.yml
+      gitleaks_config_path: .github/scan_tools_configs/gitleaks.toml
+      trivy_config_path: .github/scan_tools_configs/trivy.yml
+      zizmor_config_path: .github/scan_tools_configs/zizmor.yml