Repository navigation
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
Summary
Change: Feature Merge Risk:
 |
2f0e7cf to
538bef3
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to GitHub limitations.
security-suite.yml:56
.github/workflows/security-suite.yml:56
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winimportant: Scope the nSpect fallback to this repository.
Line 56 applies
NSPECT-ZY2K-Y1V8to every caller whenvars.NSPECT_IDis empty. The job condition also permits another repository to opt in throughCI_CUSTOMIZATIONS_SECURITY_SUITE_ENABLED. The reusable workflow definesnspect-idas the calling repository's registration, so another repository can attribute both scan results to cuda-python's registration. Scope the fallback toNVIDIA/cuda-pythonand fail or skip when another repository has noNSPECT_ID. (raw.githubusercontent.com)Source: Path instructions
-
-
- Source mode: Auto
- Repository: NVIDIA/cuda-python
- Branch: main
- File: .coderabbit.yaml
- Commit: 590a8bf
- Layers: Repository YAML
- Review profile: CHILL
- Plan: Enterprise
- Run ID:
6a8de3fc-b2c9-4bc1-bfb8-beb92c5fa8bc
-
.github/workflows/security-suite.yml
Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 10 remain after this review.
-
|
There was a problem hiding this comment.
-
-
- Source mode: Auto
- Repository: NVIDIA/cuda-python
- Branch: main
- File: .coderabbit.yaml
- Commit: 590a8bf
- Layers: Repository YAML
- Review profile: CHILL
- Plan: Enterprise
- Run ID:
7cafac23-48d5-40ca-95ff-f532ee87b70c
-
.github/workflows/security-suite.yml
Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.
-
|
Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually. Contributors can view more details about this message here. |
aa743d9 to
59e7442
Compare
|
/ok to test 59e7442 |
|
/ok to test bb07086 |
|
/ok to test 5d8f919 |
|
/ok to test 9a2dd68 |
|
/ok to test a3d6ace |
|
/ok to test 6b57543 |
|
/ok to test 0202fd0 |
|
/ok to test a13567c |
…Suite Turns on enable-vuln-scan and enable-malware-scan and moves every security-workflows pin -- the reusable suite and the secret-scan pre-commit hook -- to the v0.5.0 release commit, the first release carrying either workflow. The vulnerability scan starts report-only so a finding baseline can be built before it gates merges; scanner and transport errors still fail the job, and inventory writeback stays off. The malware scan keeps the upstream default of strict, where SUSPICIOUS blocks as well as MALICIOUS. On main the vulnerability scan inspects installed wheels, because Detect cannot resolve cuda_core's CUDA-dependent build or cuda_python's dynamic setup.py from source; two new jobs build and collect them. Wheel mode is refused on pull-request/* mirrors, which instead scan source with those two packages excluded. Both scans report to the same nSpect registration, because an nSpect ID identifies the repository rather than one scan. nspect-id reads the NSPECT_ID Actions variable -- a reusable workflow's inputs cannot read secrets -- and an empty value fails the suite preflight rather than reporting to the wrong program. No permission change: the suite's union is contents/actions read plus id-token and security-events write, all of which this caller already grants. Both scans cross a Charon tunnel that authorizes per repository and per ref; the prerequisites are summarised in ci/README.md.
a13567c to
1bd3b7d
Compare
|
/ok to test 1bd3b7d |
|
/ok to test aff64b7 |
| set -euo pipefail | ||
| mkdir wheelhouse | ||
| cp built/*.whl wheelhouse/ | ||
| python -m pip download --only-binary=:all: --dest wheelhouse wheelhouse/*.whl |
There was a problem hiding this comment.
important: Resolve dependencies against the built wheels.
pip download does not search wheelhouse for dependencies without --find-links. On a prerelease build, cuda-python requires the matching cuda-bindings version. If that version is not published, wheel collection fails despite having built it. Add --find-links wheelhouse so resolution can use the local wheels. (raw.githubusercontent.com)
As per path instructions, review “status and check behavior” for GitHub workflows.
Source: Path instructions
| vars.CI_CUSTOMIZATIONS_SECURITY_SUITE_ENABLED == 'true' | ||
| uses: NVIDIA/security-workflows/.github/workflows/security-suite.yml@c736f0454dc99764a66af6b906adfcdfbf621985 # v0.4.0 | ||
| !cancelled() && | ||
| (needs.python-wheels.result == 'success' || github.ref != 'refs/heads/main') && |
There was a problem hiding this comment.
important: Keep independent scans running when wheel preparation fails.
On main, a failed python-wheels job makes this condition false. The entire reusable suite then skips, including the secret and SAST scans that do not use the wheels. Run those scans independently of wheel preparation, and gate only the wheel-dependent vulnerability scan on its success. (raw.githubusercontent.com)
As per path instructions, review “status and check behavior” for GitHub workflows.
Source: Path instructions
Turns on
enable-vuln-scanandenable-malware-scan, and moves every NVIDIA/security-workflows pin — the reusable suite and thesecret-scan-trufflehogpre-commit hook — to0659a2e36defdf66209a135d216f40a63b7aec94, the v0.5.0 release commit. That is the first release carrying either workflow.The vulnerability scan starts report-only so a finding baseline can be built before it gates merges; scanner and transport errors still fail the job, and inventory writeback stays off. The malware scan keeps the upstream default of strict, where SUSPICIOUS blocks as well as MALICIOUS.
On
mainthe vulnerability scan inspects installed wheels, because Detect cannot resolvecuda_core's CUDA-dependent build orcuda_python's dynamicsetup.pyfrom source; two new jobs build and collect them. Wheel mode is refused onpull-request/*mirrors, which instead scan source with those two packages excluded.Both scans report to the same nSpect registration, because an nSpect ID identifies the repository rather than one scan.
nspect-idreads theNSPECT_IDActions variable — a reusable workflow's inputs cannot read secrets, so it must be a variable, not a secret — and an empty value fails the suite preflight rather than reporting to the wrong program.No permission change: the suite's union is contents/actions read plus id-token and security-events write, all of which this caller already grants.
Both scans cross a Charon tunnel that authorizes per repository and per ref. charon!242 brings this repository's tenant to parity with the one the upstream workflows are tested against and grants
mainplus thepull-request/*mirrors; the prerequisites are summarised inci/README.md.Description
closes
Checklist