chore: add security scanning workflows

.github/dependabot.yml

@@ -1,18 +1,25 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+# Copyright Advanced Micro Devices, Inc.
+# SPDX-License-Identifier: MIT
+#
+# Dependabot version updates. See
+# https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference
 
 version: 2
 updates:
-  - package-ecosystem: "pip" # See documentation for possible values
-    directory: "/docs/sphinx" # Location of package manifests
-    open-pull-requests-limit: 10
+  - package-ecosystem: "github-actions"
+    # "/" covers .github/workflows; composite actions keep their own `uses:`
+    # pins, so .github/actions has to be listed separately to get bumped.
+    directories:
+      - "/"
+      - "/.github/actions/*"
     schedule:
-      interval: "daily"
-    target-branch: "develop"
-    labels:
-      - "documentation"
-      - "dependencies"
-    reviewers:
-      - "samjwu"
+      interval: "weekly"
+      day: "saturday"
+      time: "10:00"
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/scan_tools_configs/bandit.yml

@@ -0,0 +1,18 @@
+# bandit minimal configuration
+# Reference: https://bandit.readthedocs.io/en/latest/config.html
+#
+# The default for repositories that ship no bandit config of their own.
+# A repository that ships one (`bandit.yaml` or `bandit.yml`) replaces
+# this file wholesale rather than layering onto it, so suppressions and
+# tuning that belong to a single repository (e.g. `skips: [...]`) belong
+# there. What goes here is what should hold for a repository that has
+# said nothing.
+
+exclude_dirs:
+  - .git
+  - .venv
+  - venv
+  - build
+  - dist
+  - node_modules
+  - __pycache__

.github/scan_tools_configs/gitleaks.toml

@@ -0,0 +1,69 @@
+# gitleaks.toml
+# Reference: https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml
+#
+# The default for repositories that ship no gitleaks config of their
+# own. A repository that ships one replaces this file wholesale rather
+# than layering onto it, so suppressions that belong to a single
+# repository belong in that repository's `gitleaks.toml` and
+# `.gitleaksignore`, not here. What goes here is what should hold for a
+# repository that has said nothing.
+#
+# Within a scan, the layering is:
+#   * the `[[allowlists]]` below, applying to every rule.
+#   * `.gitleaksignore` at the scanned repo's root, carrying one-off
+#     fingerprint suppressions for historical findings that don't fit
+#     a structural rule. Keep that file shrinking; move recurring
+#     patterns up into a config when you see them.
+
+title = "gitleaks config"
+
+[extend]
+# Inherit gitleaks' built-in ruleset (rotations, AWS, GCP, Slack, ...).
+# Setting this to false would mean rolling our own detections, which
+# is almost never what you want.
+useDefault = true
+
+
+
+# Allowlist field-vs-target reference:
+#   stopwords         -> always matched against the SECRET value.
+#   regexes           -> matched against `regexTarget` (default: "secret").
+#   regexTarget       -> "secret" | "match" | "line".
+# Use "match" or "line" when the "tell" is the variable name or
+# surrounding syntax, not the value itself.
+
+[[allowlists]]
+# Allowlist by location only where a real first-party secret structurally
+# can't live. Dependency lock files qualify: their contents are generated
+# from a manifest, and the high-entropy strings they carry are artifact
+# digests rather than credentials. Add vendored third-party trees here as
+# callers bring them in, one explicit path per entry.
+description = "Generated dependency lock files"
+paths = [
+  '''.*\.lock$''',
+]
+
+[[allowlists]]
+description = "Test fixtures using well-known dummy variable names"
+# The "tell" here is the variable name on the same line, not the value
+# (the value is a random-looking string by design). Match against the
+# full rule match (variable + value) so we anchor on the identifier.
+regexTarget = "match"
+regexes = [
+  '''(?i)\bINVALID_TOKEN\s*=''',
+  '''(?i)\bwrong_secret\s*=''',
+  '''(?i)\bsecret\s*='''
+]
+
+[[allowlists]]
+description = "Public artifact digests (variable names ending in SHA256/512/MD5)"
+# SHA-256/512/MD5 hashes of public artifacts (tarballs, GPG keys,
+# mirrored binaries) are not secrets - they're one-way digests used
+# for integrity verification. Match by variable name (against the
+# whole line) so we don't broadly allowlist every 64-char hex string.
+regexTarget = "line"
+regexes = [
+  '''[A-Z][A-Z0-9_]*SHA256\s*[=:]''',
+  '''[A-Z][A-Z0-9_]*SHA512\s*[=:]''',
+  '''[A-Z][A-Z0-9_]*MD5\s*[=:]''',
+]

.github/scan_tools_configs/trivy.yml

@@ -0,0 +1,19 @@
+# trivy minimal configuration
+# Reference: https://trivy.dev/latest/docs/references/configuration/config-file/
+#
+# The default for repositories that ship no trivy config of their own.
+# A repository that ships one (`trivy.yaml` or `trivy.yml`) replaces this
+# file wholesale rather than layering onto it, so suppressions and tuning
+# that belong to a single repository (e.g. `vulnerability.ignore-unfixed`,
+# or a `.trivyignore`) belong there. What goes here is what should hold
+# for a repository that has said nothing.
+
+scan:
+  skip-dirs:
+    - .git
+    - .venv
+    - venv
+    - build
+    - dist
+    - node_modules
+    - __pycache__

.github/scan_tools_configs/zizmor.yml

@@ -0,0 +1,15 @@
+# zizmor minimal configuration
+# Reference: https://docs.zizmor.sh/configuration/
+#
+# The default for repositories that ship no zizmor config of their own.
+# A repository that ships one (`.github/zizmor.yml`, `.github/zizmor.yaml`,
+# `zizmor.yml` or `zizmor.yaml`) replaces this file wholesale rather than
+# layering onto it, so suppressions that belong to a single repository
+# belong there. What goes here is what should hold for a repository that
+# has said nothing.
+#
+# Per-rule ignore lists and tuning live under `rules:`, as
+# `<rule-id>: { ignore: [file.yml:line:col] }`, which keeps a suppression
+# reviewable in one place rather than scattered as inline comments
+# across workflows.
+rules: {}

.github/workflows/pr-security-scan.yml

@@ -0,0 +1,23 @@
+# Copyright Advanced Micro Devices, Inc.
+# SPDX-License-Identifier: MIT
+#
+# PR-time security scan. Requests human-readable reports only: findings are
+# uploaded as a build artifact and printed to the job summary, never to the
+# Security tab, so fork PRs (which never receive elevated tokens) behave
+# identically to same-repo PRs. See the scheduled counterpart
+# (security_scan_weekly.yml) for the SARIF / code-scanning upload.
+
+name: Security scan (PR)
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  security:
+    name: Security scan
+    uses: ROCm/rocm-security-gh/.github/workflows/security-baseline.yml@3a1bd0da89771757df435817daae14d1635b7fdb # v1.0.1
+    with:
+      report_formats: human

.github/workflows/weekly-security-scan.yml

@@ -0,0 +1,31 @@
+# Copyright Advanced Micro Devices, Inc.
+# SPDX-License-Identifier: MIT
+#
+# Trusted security scan: full-repo scan (scan_mode: all) with SARIF results
+# uploaded to the Security tab. `security-events: write` is granted on the
+# `uses:` job itself, not just the top-level `permissions:` block above it,
+# since a `permissions:` block (wherever declared) implicitly zeroes out
+# anything it doesn't list. See the PR-time counterpart
+# (security_scan_pr.yml) for the human-readable, non-elevated variant.
+
+name: Security scan (Weekly)
+
+on:
+  # Run every Saturday at 10:00 UTC.
+  schedule:
+    - cron: "0 10 * * 6"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  security:
+    name: Security scan
+    permissions:
+      contents: read
+      security-events: write
+    uses: ROCm/rocm-security-gh/.github/workflows/security-baseline.yml@3a1bd0da89771757df435817daae14d1635b7fdb # v1.0.1
+    with:
+      scan_mode: all
+      report_formats: sarif