chore: update security scanning workflows

.github/dependabot.yml

@@ -7,15 +7,18 @@
 version: 2
 updates:
   - package-ecosystem: "github-actions"
-    # "/" covers the workflows in .github/workflows.
-    directories:
-      - "/"
+    # "/" covers .github/workflows; composite actions keep their own `uses:`
+    # pins, so .github/actions has to be listed separately to get bumped.
+    directory: "/"
     schedule:
       interval: "daily"
-    commit-message:
-      prefix: "chore"
-      include: "scope"
+      # Wait a week before adopting newly released action versions.
+    cooldown:
+      default-days: 7
+      exclude:
+        - "ROCm/rocm-security-gh*"
     groups:
+      rocm-security-gh:
+        patterns: ["ROCm/rocm-security-gh*"]
       github-actions:
-        patterns:
-          - "*"
+        patterns: ["*"]

.github/scan_tools_configs/.gitleaksignore

@@ -0,0 +1,13 @@
+# Copyright Advanced Micro Devices, Inc.
+# SPDX-License-Identifier: MIT
+#
+# Reference: https://github.com/gitleaks/gitleaks#gitleaksignore
+#
+# One finding fingerprint per line, copied from a gitleaks report
+# (`<commit>:<path>:<rule-id>:<line>`). A line starting with # is a
+# comment and suppresses nothing. Remove the leading # to activate an
+# example:
+#
+#   3f2a9c1e...:tests/fixtures/creds.py:generic-api-key:12
+#
+# Entries here combine with a .gitleaksignore at the repository root.

.github/scan_tools_configs/.trivyignore

@@ -0,0 +1,19 @@
+# Copyright Advanced Micro Devices, Inc.
+# SPDX-License-Identifier: MIT
+#
+# Reference: https://trivy.dev/latest/docs/configuration/filtering/#trivyignore
+#
+# One vulnerability, misconfiguration, or secret rule ID per line.
+# A line starting with # is a comment and suppresses nothing. Remove the
+# leading # to activate an example:
+#
+#   CVE-2019-14697 exp:2027-01-01
+#   AVD-DS-0002
+#   generic-unwanted-rule
+#
+# `exp:YYYY-MM-DD` limits a suppression to that date. After it, trivy
+# reports the finding again.
+#
+# This file sits beside the configured trivy.yml, so the scan uses it.
+# A .trivyignore at the repository root applies only when this file is
+# absent; the two are never merged.

.github/scan_tools_configs/bandit.yml

@@ -1,19 +1,32 @@
-# bandit configuration for rocMLIR
+# Copyright Advanced Micro Devices, Inc.
+# SPDX-License-Identifier: MIT
+#
+# bandit configuration
 # Reference: https://bandit.readthedocs.io/en/latest/config.html
+# Local scan: bandit --recursive . --configfile .github/scan_tools_configs/bandit.yml
+#
+# Bandit configuration for this repository's security scans.
+#
+# This file defines the complete scanner policy;
+# Keep repository-specific suppressions and tuning here.
+#
+# Bandit has no ignore file. Suppress a finding with:
+#
+#   1. `# nosec <test ID>` on the flagged line:
+#          subprocess.run(cmd, shell=True)  # nosec B602 # cmd is a constant
+#
+#   2. `skips:` for test IDs disabled across the repository:
+#          skips: [B101]
 #
-# pr-security-scan.yml and weekly-security-scan.yml pass this file to the
-# shared ROCm/rocm-security-gh scan, where it replaces the shared default
-# config wholesale rather than layering onto it. Exclusions and suppressions
-# for this repository (e.g. `skips: [...]`) belong here.
+#   3. `exclude_dirs:` below for paths Bandit should not scan.
 
+# Environment and generated-output exclusions support local scans; these
+# paths are absent from clean CI checkouts.
 exclude_dirs:
   - .git
-  - .venv
-  - venv
+  - .venv*
+  - venv*
   - build
   - dist
   - node_modules
   - __pycache__
-  # Vendored upstream trees. Bandit treats each entry as a substring of the
-  # scanned path, so the slashes keep this exclusion to the directory.
-  - /external/

.github/scan_tools_configs/gitleaks.toml

@@ -1,16 +1,31 @@
-# gitleaks configuration for rocMLIR
+# Copyright Advanced Micro Devices, Inc.
+# SPDX-License-Identifier: MIT
+#
+# gitleaks.toml
 # Reference: https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml
+# Local scan: gitleaks detect --source . --config .github/scan_tools_configs/gitleaks.toml
+#
+# Gitleaks configuration for this repository's security scans.
+#
+# This file defines the repository's complete Gitleaks policy. Recurring
+# exclusions belong in this file.
+#
+# The `[extend]` section inherits Gitleaks' built-in rules, and the
+# `[[allowlists]]` below apply to every rule.
 #
-# pr-security-scan.yml and weekly-security-scan.yml pass this file to the
-# shared ROCm/rocm-security-gh scan, where it replaces the shared default
-# config wholesale rather than layering onto it.
+# Ways to suppress a finding, narrowest first:
 #
-# Within a scan, the layering is:
-#   * the `[[allowlists]]` below, applying to every rule.
-#   * `.gitleaksignore` at the scanned repo's root, carrying one-off
-#     fingerprint suppressions for historical findings that don't fit
-#     a structural rule. Keep that file shrinking; move recurring
-#     patterns up into a config when you see them.
+#   1. `gitleaks:allow` on the offending line:
+#          api_key = "not-a-real-key"  # gitleaks:allow
+#
+#   2. `.gitleaksignore` with one finding fingerprint per line:
+#          3f2a9c1e...:tests/fixtures/creds.py:generic-api-key:12
+#      Reference: https://github.com/gitleaks/gitleaks#gitleaksignore
+#      Keep it beside this file (`.github/scan_tools_configs/.gitleaksignore`)
+#      or at the repository root. When both exist, their entries combine.
+#      The `.gitleaksignore` here is a commented placeholder.
+#
+#   3. `[[allowlists]]` below for recurring paths, regexes or stopwords.
 
 title = "gitleaks config"
 
@@ -33,18 +48,13 @@ useDefault = true
 # Allowlist by location only where a real first-party secret structurally
 # can't live. Dependency lock files qualify: their contents are generated
 # from a manifest, and the high-entropy strings they carry are artifact
-# digests rather than credentials.
+# digests rather than credentials. Add vendored third-party trees here as
+# callers bring them in, one explicit path per entry.
 description = "Generated dependency lock files"
 paths = [
   '''.*\.lock$''',
 ]
 
-[[allowlists]]
-description = "Vendored upstream trees"
-paths = [
-  '''^external/''',
-]
-
 [[allowlists]]
 description = "Test fixtures using well-known dummy variable names"
 # The "tell" here is the variable name on the same line, not the value
@@ -54,28 +64,16 @@ regexTarget = "match"
 regexes = [
   '''(?i)\bINVALID_TOKEN\s*=''',
   '''(?i)\bwrong_secret\s*=''',
-  '''(?i)\bsecret\s*='''
-]
-
-[[allowlists]]
-description = "Dummy gateway key in the Claude sanitizer tests"
-# The sanitizer tests feed this made-up key to the sanitizer to verify that it
-# is rejected. Requiring both the exact path and value means a real secret in
-# the test file is still reported.
-condition = "AND"
-paths = [
-  '''^\.github/scripts/tests/test_sanitize\.sh$''',
-]
-regexes = [
-  '''^sk-secret-xyzzy-12345$''',
+  # Explicit test-only secret identifiers
+  '''(?i)\btest_secret\s*=''',
+  '''(?i)\bdummy_secret\s*=''',
+  '''(?i)\bfake_secret\s*=''',
+  '''(?i)\bexample_secret\s*='''
 ]
 
 [[allowlists]]
 description = "Public artifact digests (variable names ending in SHA256/512/MD5)"
-# SHA-256/512/MD5 hashes of public artifacts (tarballs, GPG keys,
-# mirrored binaries) are not secrets - they're one-way digests used
-# for integrity verification. Match by variable name (against the
-# whole line) so we don't broadly allowlist every 64-char hex string.
+# SHA-256/512/MD5 hashes of public artifacts are not secrets.
 regexTarget = "line"
 regexes = [
   '''[A-Z][A-Z0-9_]*SHA256\s*[=:]''',

.github/scan_tools_configs/trivy.yml

@@ -1,19 +1,38 @@
-# trivy configuration for rocMLIR
+# Copyright Advanced Micro Devices, Inc.
+# SPDX-License-Identifier: MIT
+#
+# trivy configuration
 # Reference: https://trivy.dev/latest/docs/references/configuration/config-file/
+# Local scan: trivy fs --config .github/scan_tools_configs/trivy.yml .
+#
+# Trivy configuration for this repository's security scans.
+#
+# This file defines the complete scanner policy;
+# Keep repository-specific suppressions and tuning here.
+#
+# Ways to suppress a finding, narrowest first:
+#
+#   1. `.trivyignore` -- one vulnerability, misconfiguration or secret rule
+#      ID per line. Add `exp:YYYY-MM-DD` for a temporary suppression:
+#          CVE-2019-14697 exp:2027-01-01
+#      Reference: https://trivy.dev/latest/docs/configuration/filtering/#trivyignore
+#      Keep it beside this file (`.github/scan_tools_configs/.trivyignore`)
+#      or at the repository root. The file beside this config takes
+#      precedence; the two are never merged. The `.trivyignore` here is
+#      a commented placeholder.
 #
-# pr-security-scan.yml and weekly-security-scan.yml pass this file to the
-# shared ROCm/rocm-security-gh scan, where it replaces the shared default
-# config wholesale rather than layering onto it. Tuning for this repository
-# belongs here; per-finding suppressions go in a .trivyignore at the root.
+#   2. `scan.skip-dirs` / `scan.skip-files` below -- paths trivy never
+#      reads, for vendored trees and generated output. Anything found only
+#      there is not scanned at all, so keep entries narrow.
 
+# Environment and generated-output exclusions support local scans; these
+# paths are absent from clean CI checkouts.
 scan:
   skip-dirs:
     - .git
-    - .venv
-    - venv
+    - .venv*
+    - venv*
     - build
     - dist
     - node_modules
     - __pycache__
-    # Vendored upstream trees.
-    - external

.github/scan_tools_configs/zizmor.yml

@@ -1,21 +1,33 @@
-# zizmor configuration for rocMLIR
+# Copyright Advanced Micro Devices, Inc.
+# SPDX-License-Identifier: MIT
+#
+# zizmor configuration
 # Reference: https://docs.zizmor.sh/configuration/
+# Local scan: zizmor --config .github/scan_tools_configs/zizmor.yml .
+#
+# Zizmor configuration for this repository's security scans.
+#
+# This file defines the complete scanner policy;
+# Keep repository-specific suppressions and tuning here.
+#
+# Zizmor has no ignore file. Suppress a finding with:
+#
+#   1. An inline comment naming the rule:
+#          run: | # zizmor: ignore[template-injection] input is validated
+#
+#   2. `rules.<rule-id>.ignore` with `<file>[:<line>[:<col>]]`:
+#          rules:
+#            template-injection:
+#              ignore:
+#                - safe.yml
 #
-# pr-security-scan.yml and weekly-security-scan.yml pass this file to the
-# shared ROCm/rocm-security-gh scan, where it replaces the shared default
-# config wholesale rather than layering onto it. Zizmor has no path
-# exclusions; vendored workflows are kept out by /external/*/.github in the
-# root .gitignore.
+#   3. `rules.<rule-id>.disable: true` to disable a rule repository-wide.
 #
-# Per-rule ignore lists and tuning live under `rules:`, as
-# `<rule-id>: { ignore: [file.yml:line:col] }`, which keeps a suppression
-# reviewable in one place rather than scattered as inline comments
-# across workflows.
+# Add rule-specific settings and suppressions under `rules:`.
+
 rules:
-  dangerous-triggers:
-    ignore:
-      # These companions need pull_request_target to label and comment on fork
-      # PRs. Neither checks out nor runs PR code; both default to no permissions
-      # and use explicitly scoped App tokens. See CLAUDE_AUTO_REVIEW.md.
-      - claude_auto_review_fork_notify.yml
-      - claude_auto_review_perimeter_banner.yml
+  unpinned-uses:
+    config:
+      policies:
+        # Security owns this workflow and moves the v1 tag.
+        ROCm/rocm-security-gh/.github/workflows/security-baseline.yml: ref-pin

.github/workflows/pr-security-scan.yml

@@ -1,16 +1,15 @@
 # Copyright Advanced Micro Devices, Inc.
 # SPDX-License-Identifier: MIT
 #
-# PR security gate: fast, PR-side security scanners that run on every pull
-# request. This complements the premerge checks in `ci.yml`. The set of
-# scanners lives in `security-baseline.yml`, so scanners coming online are
-# picked up here without touching this file.
+# Pre-commit security gate: fast, PR-side security scanners that run on
+# every pull request. Scanner selection and policy are defined by the pinned
+# ROCm/rocm-security-gh `security-baseline.yml` reusable workflow.
 #
-# `report_formats: human` applies to Bandit, Gitleaks, Trivy, and Zizmor:
-# their findings are uploaded as build artifacts and printed to job summaries.
-# GitHub permits code-scanning uploads triggered by `pull_request` even without
-# `security-events: write`, so CodeQL uploads its results independently. See
-# weekly-security-scan.yml for non-PR SARIF uploads and explicit permission.
+# Requests human-readable reports only: findings are uploaded as a build
+# artifact and printed to the job summary, never to the Security tab, so
+# fork PRs (which never receive elevated tokens) behave identically to
+# same-repo PRs. See the scheduled counterpart (weekly-security-scan.yml)
+# for the SARIF / code-scanning upload.
 
 name: Security scan (PR)
 
@@ -29,7 +28,12 @@ concurrency:
 jobs:
   security:
     name: Security scan
-    uses: ROCm/rocm-security-gh/.github/workflows/security-baseline.yml@62c2c4f3effcd47711da28276815c90cb4aa6444 # v1.0.2
+    permissions:
+      actions: read
+      contents: read
+      pull-requests: write
+    # Trust Security-managed v1 updates to minimize developer update noise.
+    uses: ROCm/rocm-security-gh/.github/workflows/security-baseline.yml@v1
     with:
       report_formats: human
       bandit_config_path: .github/scan_tools_configs/bandit.yml

.github/workflows/weekly-security-scan.yml

@@ -5,11 +5,6 @@
 # to the repository's code-scanning Security tab. Complements
 # `pr-security-scan.yml`, which scans only what changed in a PR and
 # uploads reviewer-readable artifacts for in-review browsing.
-#
-# `security-events: write` is granted on the `uses:` job itself, not just
-# the top-level `permissions:` block above it, since a `permissions:`
-# block (wherever declared) implicitly zeroes out anything it doesn't
-# list.
 
 name: Security scan (Weekly)
 
@@ -29,7 +24,8 @@ jobs:
     permissions:
       contents: read
       security-events: write
-    uses: ROCm/rocm-security-gh/.github/workflows/security-baseline.yml@62c2c4f3effcd47711da28276815c90cb4aa6444 # v1.0.2
+    # Trust Security-managed v1 updates to minimize developer update noise.
+    uses: ROCm/rocm-security-gh/.github/workflows/security-baseline.yml@v1
     with:
       scan_mode: all
       report_formats: sarif