[haribabug]

Security Scanning Workflows — Update

This PR syncs the security scanning configuration with the latest version from
ROCm/rocm-repo-template.

The original "chore: add security scanning workflows" PR for this repository has already been merged;
this follow-up brings the following file(s) back in line with the template:

• .github/workflows/pr-security-scan.yml
• .github/workflows/weekly-security-scan.yml
• .github/dependabot.yml
• .github/scan_tools_configs/bandit.yml
• .github/scan_tools_configs/gitleaks.toml
• .github/scan_tools_configs/trivy.yml
• .github/scan_tools_configs/zizmor.yml

Why

The template evolved after the initial rollout. This keeps this repository aligned
with the ROCm GitHub Organization Security Baseline.

---

For more details, refer ROCm GitHub Org Security Controls Baseline Architecture

Support/Questions: Teams Channel ROCm Security Discussions

[github-actions]

Caution

25 potential secret finding(s) were committed in this pull request. Treat each credential as compromised and revoke or rotate it now, even if a later commit removed it. Deleting the line or force-pushing does not undo the leak: the commits stay reachable from this pull request and from every clone or fork, and automated scanners harvest secrets pushed to public repositories within minutes.

If a finding is a test fixture or a false positive, allowlist it in the configuration of the scanner that reported it.

Security scan found 25 critical or high finding(s) on lines changed by this pull request (coverage incomplete)

Scanner	Severity	Rule	Location	Finding
Gitleaks	HIGH	generic-api-key	.github/scripts/tests/test_sanitize.sh:37	Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
Gitleaks	HIGH	generic-api-key	.github/scripts/tests/test_sanitize.sh:304	Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
Gitleaks	HIGH	generic-api-key	.github/scripts/tests/test_sanitize.sh:306	Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
Gitleaks	HIGH	generic-api-key	external/llvm-project/clang/lib/Lex/LiteralSupport.cpp:2117	Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
Gitleaks	HIGH	generic-api-key	external/llvm-project/clang/test/CodeGenCXX/microsoft-abi-virtual-inheritance.cpp:6	Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
Gitleaks	HIGH	generic-api-key	external/llvm-project/clang/test/InterfaceStubs/class-template-specialization.cpp:20	Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
Gitleaks	HIGH	generic-api-key	external/llvm-project/lld/test/ELF/aarch64-build-attributes-be.s:24	Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
Gitleaks	HIGH	generic-api-key	external/llvm-project/lld/test/ELF/aarch64-build-attributes-be.s:25	Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
Gitleaks	HIGH	generic-api-key	external/llvm-project/lldb/test/API/symstore/TestSymStore.py:38	Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
Gitleaks	HIGH	generic-api-key	external/llvm-project/lldb/test/Shell/ScriptInterpreter/Python/Crashlog/Inputs/a.out.inline.ips:29	Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
Gitleaks	HIGH	generic-api-key	external/llvm-project/lldb/test/Shell/ScriptInterpreter/Python/Crashlog/Inputs/a.out.ips:29	Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
Gitleaks	HIGH	generic-api-key	external/llvm-project/lldb/test/Shell/ScriptInterpreter/Python/Crashlog/Inputs/application_specific_info/asi.txt:30	Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
Gitleaks	HIGH	generic-api-key	external/llvm-project/lldb/test/Shell/ScriptInterpreter/Python/Crashlog/Inputs/application_specific_info/leb.txt:30	Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
Gitleaks	HIGH	generic-api-key	external/llvm-project/lldb/test/Shell/ScriptInterpreter/Python/Crashlog/Inputs/interactive_crashlog/multithread-test.ips:8	Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
Gitleaks	HIGH	generic-api-key	external/llvm-project/lldb/test/Shell/ScriptInterpreter/Python/Crashlog/Inputs/no_threadState.ips:29	Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
Gitleaks	HIGH	generic-api-key	external/llvm-project/llvm/include/llvm/IR/IntrinsicsAArch64.td:875	Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
Gitleaks	HIGH	generic-api-key	external/llvm-project/llvm/lib/Analysis/BasicAliasAnalysis.cpp:1430	Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
Gitleaks	HIGH	generic-api-key	external/llvm-project/llvm/lib/Analysis/BasicAliasAnalysis.cpp:1431	Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
Gitleaks	HIGH	generic-api-key	external/llvm-project/llvm/unittests/Analysis/Inputs/ir2native_x86_64_model/saved_model.pbtxt:1728	Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
Gitleaks	HIGH	generic-api-key	external/llvm-project/llvm/unittests/Analysis/Inputs/ir2native_x86_64_model/saved_model.pbtxt:1732	Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
Gitleaks	HIGH	generic-api-key	external/llvm-project/llvm/unittests/Analysis/Inputs/ir2native_x86_64_model/saved_model.pbtxt:1736	Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
Gitleaks	HIGH	generic-api-key	external/llvm-project/llvm/unittests/Analysis/Inputs/ir2native_x86_64_model/saved_model.pbtxt:1740	Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
Gitleaks	HIGH	generic-api-key	external/llvm-project/llvm/unittests/Analysis/Inputs/ir2native_x86_64_model/saved_model.pbtxt:1744	Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
Gitleaks	HIGH	generic-api-key	external/llvm-project/llvm/unittests/Analysis/Inputs/ir2native_x86_64_model/saved_model.pbtxt:1748	Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
Gitleaks	HIGH	generic-api-key	external/llvm-project/llvm/unittests/Analysis/Inputs/ir2native_x86_64_model/saved_model.pbtxt:1752	Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Coverage was incomplete:

• Security scan / trivy concluded with failure.
• Security scan / Security scanners concluded with failure.

View the security scan run for complete reports.

“New” means the finding is located in a changed file on an added or modified line; it is not a base-versus-head findings delta.

[rmt-pr-reviewer]

⚠️ This PR modifies the Claude-review CI security perimeter

The following files in this PR control whether and how the
claude-review workflow protects its LLM Gateway secrets at
runtime (see .github/workflows/CLAUDE_AUTO_REVIEW.md):

• .github/workflows/pr-security-scan.yml
• .github/workflows/weekly-security-scan.yml

Before applying the claude-review label on this PR, please:

1. Audit the diff in these paths line-by-line. A malicious or
   accidental change could disable the --allowedTools
   restriction, the overlay step, the sanitizer, or the
   review/post job split -- any of which would expose the
   secrets in env to the PR-modified workflow.
2. If the changes are legitimate and you want a Claude review,
   do NOT apply the claude-review label. Instead, run via
   Actions → Claude Auto Review → Run workflow and enter
   this PR's number. The dispatch path runs from the trusted,
   code-owner-approved version of the workflow on
   develop, so a malicious PR-side
   modification cannot affect the run.

(This banner is automated. The modifies-ci-paths label
will be removed automatically if a future push removes the
perimeter modifications. The Layer-3 in-workflow guard will
additionally fail the claude-review label-triggered run
on this PR if the label is applied while perimeter changes
are present.)