diff --git a/.github/dependabot.yml b/.github/dependabot.yml index dd8140504f93..477178c9018c 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -7,15 +7,18 @@ version: 2 updates: - package-ecosystem: "github-actions" - # "/" covers the workflows in .github/workflows. - directories: - - "/" + # "/" covers .github/workflows; composite actions keep their own `uses:` + # pins, so .github/actions has to be listed separately to get bumped. + directory: "/" schedule: interval: "daily" - commit-message: - prefix: "chore" - include: "scope" + # Wait a week before adopting newly released action versions. + cooldown: + default-days: 7 + exclude: + - "ROCm/rocm-security-gh*" groups: + rocm-security-gh: + patterns: ["ROCm/rocm-security-gh*"] github-actions: - patterns: - - "*" + patterns: ["*"] diff --git a/.github/scan_tools_configs/.gitleaksignore b/.github/scan_tools_configs/.gitleaksignore new file mode 100644 index 000000000000..1e3cd3c5f530 --- /dev/null +++ b/.github/scan_tools_configs/.gitleaksignore @@ -0,0 +1,13 @@ +# Copyright Advanced Micro Devices, Inc. +# SPDX-License-Identifier: MIT +# +# Reference: https://github.com/gitleaks/gitleaks#gitleaksignore +# +# One finding fingerprint per line, copied from a gitleaks report +# (`:::`). A line starting with # is a +# comment and suppresses nothing. Remove the leading # to activate an +# example: +# +# 3f2a9c1e...:tests/fixtures/creds.py:generic-api-key:12 +# +# Entries here combine with a .gitleaksignore at the repository root. diff --git a/.github/scan_tools_configs/.trivyignore b/.github/scan_tools_configs/.trivyignore new file mode 100644 index 000000000000..26da6acf4d8e --- /dev/null +++ b/.github/scan_tools_configs/.trivyignore @@ -0,0 +1,19 @@ +# Copyright Advanced Micro Devices, Inc. +# SPDX-License-Identifier: MIT +# +# Reference: https://trivy.dev/latest/docs/configuration/filtering/#trivyignore +# +# One vulnerability, misconfiguration, or secret rule ID per line. +# A line starting with # is a comment and suppresses nothing. Remove the +# leading # to activate an example: +# +# CVE-2019-14697 exp:2027-01-01 +# AVD-DS-0002 +# generic-unwanted-rule +# +# `exp:YYYY-MM-DD` limits a suppression to that date. After it, trivy +# reports the finding again. +# +# This file sits beside the configured trivy.yml, so the scan uses it. +# A .trivyignore at the repository root applies only when this file is +# absent; the two are never merged. diff --git a/.github/scan_tools_configs/bandit.yml b/.github/scan_tools_configs/bandit.yml index 999f59c87e86..aa800efe645c 100644 --- a/.github/scan_tools_configs/bandit.yml +++ b/.github/scan_tools_configs/bandit.yml @@ -1,19 +1,32 @@ -# bandit configuration for rocMLIR +# Copyright Advanced Micro Devices, Inc. +# SPDX-License-Identifier: MIT +# +# bandit configuration # Reference: https://bandit.readthedocs.io/en/latest/config.html +# Local scan: bandit --recursive . --configfile .github/scan_tools_configs/bandit.yml +# +# Bandit configuration for this repository's security scans. +# +# This file defines the complete scanner policy; +# Keep repository-specific suppressions and tuning here. +# +# Bandit has no ignore file. Suppress a finding with: +# +# 1. `# nosec ` on the flagged line: +# subprocess.run(cmd, shell=True) # nosec B602 # cmd is a constant +# +# 2. `skips:` for test IDs disabled across the repository: +# skips: [B101] # -# pr-security-scan.yml and weekly-security-scan.yml pass this file to the -# shared ROCm/rocm-security-gh scan, where it replaces the shared default -# config wholesale rather than layering onto it. Exclusions and suppressions -# for this repository (e.g. `skips: [...]`) belong here. +# 3. `exclude_dirs:` below for paths Bandit should not scan. +# Environment and generated-output exclusions support local scans; these +# paths are absent from clean CI checkouts. exclude_dirs: - .git - - .venv - - venv + - .venv* + - venv* - build - dist - node_modules - __pycache__ - # Vendored upstream trees. Bandit treats each entry as a substring of the - # scanned path, so the slashes keep this exclusion to the directory. - - /external/ diff --git a/.github/scan_tools_configs/gitleaks.toml b/.github/scan_tools_configs/gitleaks.toml index 85dafbd30c30..f50c51eb9d27 100644 --- a/.github/scan_tools_configs/gitleaks.toml +++ b/.github/scan_tools_configs/gitleaks.toml @@ -1,16 +1,31 @@ -# gitleaks configuration for rocMLIR +# Copyright Advanced Micro Devices, Inc. +# SPDX-License-Identifier: MIT +# +# gitleaks.toml # Reference: https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml +# Local scan: gitleaks detect --source . --config .github/scan_tools_configs/gitleaks.toml +# +# Gitleaks configuration for this repository's security scans. +# +# This file defines the repository's complete Gitleaks policy. Recurring +# exclusions belong in this file. +# +# The `[extend]` section inherits Gitleaks' built-in rules, and the +# `[[allowlists]]` below apply to every rule. # -# pr-security-scan.yml and weekly-security-scan.yml pass this file to the -# shared ROCm/rocm-security-gh scan, where it replaces the shared default -# config wholesale rather than layering onto it. +# Ways to suppress a finding, narrowest first: # -# Within a scan, the layering is: -# * the `[[allowlists]]` below, applying to every rule. -# * `.gitleaksignore` at the scanned repo's root, carrying one-off -# fingerprint suppressions for historical findings that don't fit -# a structural rule. Keep that file shrinking; move recurring -# patterns up into a config when you see them. +# 1. `gitleaks:allow` on the offending line: +# api_key = "not-a-real-key" # gitleaks:allow +# +# 2. `.gitleaksignore` with one finding fingerprint per line: +# 3f2a9c1e...:tests/fixtures/creds.py:generic-api-key:12 +# Reference: https://github.com/gitleaks/gitleaks#gitleaksignore +# Keep it beside this file (`.github/scan_tools_configs/.gitleaksignore`) +# or at the repository root. When both exist, their entries combine. +# The `.gitleaksignore` here is a commented placeholder. +# +# 3. `[[allowlists]]` below for recurring paths, regexes or stopwords. title = "gitleaks config" @@ -33,18 +48,13 @@ useDefault = true # Allowlist by location only where a real first-party secret structurally # can't live. Dependency lock files qualify: their contents are generated # from a manifest, and the high-entropy strings they carry are artifact -# digests rather than credentials. +# digests rather than credentials. Add vendored third-party trees here as +# callers bring them in, one explicit path per entry. description = "Generated dependency lock files" paths = [ '''.*\.lock$''', ] -[[allowlists]] -description = "Vendored upstream trees" -paths = [ - '''^external/''', -] - [[allowlists]] description = "Test fixtures using well-known dummy variable names" # The "tell" here is the variable name on the same line, not the value @@ -54,28 +64,16 @@ regexTarget = "match" regexes = [ '''(?i)\bINVALID_TOKEN\s*=''', '''(?i)\bwrong_secret\s*=''', - '''(?i)\bsecret\s*=''' -] - -[[allowlists]] -description = "Dummy gateway key in the Claude sanitizer tests" -# The sanitizer tests feed this made-up key to the sanitizer to verify that it -# is rejected. Requiring both the exact path and value means a real secret in -# the test file is still reported. -condition = "AND" -paths = [ - '''^\.github/scripts/tests/test_sanitize\.sh$''', -] -regexes = [ - '''^sk-secret-xyzzy-12345$''', + # Explicit test-only secret identifiers + '''(?i)\btest_secret\s*=''', + '''(?i)\bdummy_secret\s*=''', + '''(?i)\bfake_secret\s*=''', + '''(?i)\bexample_secret\s*=''' ] [[allowlists]] description = "Public artifact digests (variable names ending in SHA256/512/MD5)" -# SHA-256/512/MD5 hashes of public artifacts (tarballs, GPG keys, -# mirrored binaries) are not secrets - they're one-way digests used -# for integrity verification. Match by variable name (against the -# whole line) so we don't broadly allowlist every 64-char hex string. +# SHA-256/512/MD5 hashes of public artifacts are not secrets. regexTarget = "line" regexes = [ '''[A-Z][A-Z0-9_]*SHA256\s*[=:]''', diff --git a/.github/scan_tools_configs/trivy.yml b/.github/scan_tools_configs/trivy.yml index 990f8f548494..579a2de3c309 100644 --- a/.github/scan_tools_configs/trivy.yml +++ b/.github/scan_tools_configs/trivy.yml @@ -1,19 +1,38 @@ -# trivy configuration for rocMLIR +# Copyright Advanced Micro Devices, Inc. +# SPDX-License-Identifier: MIT +# +# trivy configuration # Reference: https://trivy.dev/latest/docs/references/configuration/config-file/ +# Local scan: trivy fs --config .github/scan_tools_configs/trivy.yml . +# +# Trivy configuration for this repository's security scans. +# +# This file defines the complete scanner policy; +# Keep repository-specific suppressions and tuning here. +# +# Ways to suppress a finding, narrowest first: +# +# 1. `.trivyignore` -- one vulnerability, misconfiguration or secret rule +# ID per line. Add `exp:YYYY-MM-DD` for a temporary suppression: +# CVE-2019-14697 exp:2027-01-01 +# Reference: https://trivy.dev/latest/docs/configuration/filtering/#trivyignore +# Keep it beside this file (`.github/scan_tools_configs/.trivyignore`) +# or at the repository root. The file beside this config takes +# precedence; the two are never merged. The `.trivyignore` here is +# a commented placeholder. # -# pr-security-scan.yml and weekly-security-scan.yml pass this file to the -# shared ROCm/rocm-security-gh scan, where it replaces the shared default -# config wholesale rather than layering onto it. Tuning for this repository -# belongs here; per-finding suppressions go in a .trivyignore at the root. +# 2. `scan.skip-dirs` / `scan.skip-files` below -- paths trivy never +# reads, for vendored trees and generated output. Anything found only +# there is not scanned at all, so keep entries narrow. +# Environment and generated-output exclusions support local scans; these +# paths are absent from clean CI checkouts. scan: skip-dirs: - .git - - .venv - - venv + - .venv* + - venv* - build - dist - node_modules - __pycache__ - # Vendored upstream trees. - - external diff --git a/.github/scan_tools_configs/zizmor.yml b/.github/scan_tools_configs/zizmor.yml index 1eada006f679..a27bc9782ee4 100644 --- a/.github/scan_tools_configs/zizmor.yml +++ b/.github/scan_tools_configs/zizmor.yml @@ -1,21 +1,33 @@ -# zizmor configuration for rocMLIR +# Copyright Advanced Micro Devices, Inc. +# SPDX-License-Identifier: MIT +# +# zizmor configuration # Reference: https://docs.zizmor.sh/configuration/ +# Local scan: zizmor --config .github/scan_tools_configs/zizmor.yml . +# +# Zizmor configuration for this repository's security scans. +# +# This file defines the complete scanner policy; +# Keep repository-specific suppressions and tuning here. +# +# Zizmor has no ignore file. Suppress a finding with: +# +# 1. An inline comment naming the rule: +# run: | # zizmor: ignore[template-injection] input is validated +# +# 2. `rules..ignore` with `[:[:]]`: +# rules: +# template-injection: +# ignore: +# - safe.yml # -# pr-security-scan.yml and weekly-security-scan.yml pass this file to the -# shared ROCm/rocm-security-gh scan, where it replaces the shared default -# config wholesale rather than layering onto it. Zizmor has no path -# exclusions; vendored workflows are kept out by /external/*/.github in the -# root .gitignore. +# 3. `rules..disable: true` to disable a rule repository-wide. # -# Per-rule ignore lists and tuning live under `rules:`, as -# `: { ignore: [file.yml:line:col] }`, which keeps a suppression -# reviewable in one place rather than scattered as inline comments -# across workflows. +# Add rule-specific settings and suppressions under `rules:`. + rules: - dangerous-triggers: - ignore: - # These companions need pull_request_target to label and comment on fork - # PRs. Neither checks out nor runs PR code; both default to no permissions - # and use explicitly scoped App tokens. See CLAUDE_AUTO_REVIEW.md. - - claude_auto_review_fork_notify.yml - - claude_auto_review_perimeter_banner.yml + unpinned-uses: + config: + policies: + # Security owns this workflow and moves the v1 tag. + ROCm/rocm-security-gh/.github/workflows/security-baseline.yml: ref-pin diff --git a/.github/workflows/pr-security-scan.yml b/.github/workflows/pr-security-scan.yml index 2ba2f5f53da8..2ec6d51c4d3f 100644 --- a/.github/workflows/pr-security-scan.yml +++ b/.github/workflows/pr-security-scan.yml @@ -1,16 +1,15 @@ # Copyright Advanced Micro Devices, Inc. # SPDX-License-Identifier: MIT # -# PR security gate: fast, PR-side security scanners that run on every pull -# request. This complements the premerge checks in `ci.yml`. The set of -# scanners lives in `security-baseline.yml`, so scanners coming online are -# picked up here without touching this file. +# Pre-commit security gate: fast, PR-side security scanners that run on +# every pull request. Scanner selection and policy are defined by the pinned +# ROCm/rocm-security-gh `security-baseline.yml` reusable workflow. # -# `report_formats: human` applies to Bandit, Gitleaks, Trivy, and Zizmor: -# their findings are uploaded as build artifacts and printed to job summaries. -# GitHub permits code-scanning uploads triggered by `pull_request` even without -# `security-events: write`, so CodeQL uploads its results independently. See -# weekly-security-scan.yml for non-PR SARIF uploads and explicit permission. +# Requests human-readable reports only: findings are uploaded as a build +# artifact and printed to the job summary, never to the Security tab, so +# fork PRs (which never receive elevated tokens) behave identically to +# same-repo PRs. See the scheduled counterpart (weekly-security-scan.yml) +# for the SARIF / code-scanning upload. name: Security scan (PR) @@ -29,7 +28,12 @@ concurrency: jobs: security: name: Security scan - uses: ROCm/rocm-security-gh/.github/workflows/security-baseline.yml@62c2c4f3effcd47711da28276815c90cb4aa6444 # v1.0.2 + permissions: + actions: read + contents: read + pull-requests: write + # Trust Security-managed v1 updates to minimize developer update noise. + uses: ROCm/rocm-security-gh/.github/workflows/security-baseline.yml@v1 with: report_formats: human bandit_config_path: .github/scan_tools_configs/bandit.yml diff --git a/.github/workflows/weekly-security-scan.yml b/.github/workflows/weekly-security-scan.yml index 0ba132f60214..013c30b091d4 100644 --- a/.github/workflows/weekly-security-scan.yml +++ b/.github/workflows/weekly-security-scan.yml @@ -5,11 +5,6 @@ # to the repository's code-scanning Security tab. Complements # `pr-security-scan.yml`, which scans only what changed in a PR and # uploads reviewer-readable artifacts for in-review browsing. -# -# `security-events: write` is granted on the `uses:` job itself, not just -# the top-level `permissions:` block above it, since a `permissions:` -# block (wherever declared) implicitly zeroes out anything it doesn't -# list. name: Security scan (Weekly) @@ -29,7 +24,8 @@ jobs: permissions: contents: read security-events: write - uses: ROCm/rocm-security-gh/.github/workflows/security-baseline.yml@62c2c4f3effcd47711da28276815c90cb4aa6444 # v1.0.2 + # Trust Security-managed v1 updates to minimize developer update noise. + uses: ROCm/rocm-security-gh/.github/workflows/security-baseline.yml@v1 with: scan_mode: all report_formats: sarif