# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
#
# SPDX-License-Identifier: Apache-2.0
#
# CI security scanning via the NVIDIA/security-workflows suite: Pulse secret scan,
# Pulse OSS vulnerability scan (SCA), Pulse malware scan, and CodeQL SAST.
# Pulse runs on Linux nv-gha-runners (Docker image + OIDC/Vault) — Linux-only by design.
# The local secret-scan-trufflehog pre-commit hook is cross-platform (Linux/macOS/Windows).
# Pinned to a reviewed commit SHA.
# The vulnerability and malware scans cross a Charon tunnel; see ci/README.md.

name: Security Suite (Pulse + CodeQL)

on:
  push:
    branches:
      - main
      - ctk-next
      - "pull-request/[0-9]+"
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-on-${{ github.event_name }}-from-${{ github.ref_name }}
  cancel-in-progress: true

# Caller must grant every permission the reusable workflow declares, including scans it disables.
permissions:
  contents: read
  id-token: write          # OIDC -> Vault -> nvcr.io image pull
  security-events: write   # publish redacted SARIF to code scanning
  actions: read

jobs:
  security-suite:
    name: Security Suite
    # Repository-specific workflow opt-ins use CI_CUSTOMIZATIONS_* Actions variables;
    # see ci/README.md. Enable this only after the security-suite prerequisites exist.
    if: >-
      github.repository == 'NVIDIA/cuda-python' ||
      vars.CI_CUSTOMIZATIONS_SECURITY_SUITE_ENABLED == 'true'
    uses: NVIDIA/security-workflows/.github/workflows/security-suite.yml@2194c521256bb3a7bf6fa36add89d9ce3db17c9a  # test/vuln-malware-onboarding
    with:
      enable-secret-scan: true
      enable-vuln-scan: true
      enable-malware-scan: true
      enable-sast-scan: true
      secret-runs-on: linux-amd64-cpu4
      # Set failure_policy explicitly so enforcement can't drift with upstream defaults.
      #   unverified — fail on verified/live secrets (183); warn on unverified (185)  [default]
      #   strict     — fail on any finding (verified or unverified)
      #   all        — warn only; never fail the job on findings
      secret-failure-policy: unverified
      # Same analysis the retired codeql.yml performed: python, build-mode none, security-extended.
      sast-languages: '["python"]'
      # Literal fallback until the NSPECT_ID variable is provisioned on this repository.
      nspect-id: ${{ vars.NSPECT_ID || 'NSPECT-ZY2K-Y1V8' }}
      vuln-runs-on: linux-amd64-cpu4
      # Diagnostic trial, not a settled choice: the buildless scan can't resolve this graph because
      # Detect's setuptools and uv detectors both need the project installed. Revert if it doesn't help.
      vuln-build: true
      # report-only (default) — findings warn; fail-on-vulnerability — any finding fails. Errors always fail.
      vuln-failure-policy: report-only
      vuln-upload-report: true
      malware-runs-on: linux-amd64-cpu4
      # strict (default) — SUSPICIOUS fails too; malicious-only — it only warns. MALICIOUS always fails.
      malware-failure-policy: strict