[demandal25]

Summary

Adopts the security half of AMD's standard repository baseline: PR and weekly scans through ROCm/rocm-security-gh's security-baseline workflow (bandit, gitleaks, trivy, zizmor, CodeQL), per-tool configs tuned for this fork, Dependabot for Actions, SHA-pinned workflows, and the baseline's YAML/JSON/actionlint hooks. The baseline files are relicensed to Apache-2.0 (AMD holds their copyright), matching the fork.

What changed

• .github/workflows/pr-security-scan.yml, weekly-security-scan.yml — baseline verbatim, pinned to rocm-security-gh v1.0.6.
• .github/scan_tools_configs/* — baseline configs plus the tuning below.
• .github/dependabot.yml — baseline verbatim (github-actions).
• .github/workflows/pre-commit.yml, arch-caps-conformance.yml — SHA pins, persist-credentials: false, contents: read. pre-commit's push trigger moves from main (the deprecated stub) to amd-integration, and its job id stays pre-commit, the ruleset's required check context.
• .pre-commit-config.yaml — check-yaml, check-json, actionlint as a separate SHA-pinned entry, so upstream's pre-commit-hooks block still merges. actionlint runs with shellcheck; the baseline disables it.
• tests/rocm/test_repo_workflows.py — pins the workflow set. A sync merges a newly added upstream workflow without a conflict; upstream/main already carries seven, including pull_request_target ones.

Architecture / design notes

Adding the configs widens bandit, trivy and zizmor to the whole tree on this PR, and a HIGH finding fails it. Measured at the pinned scanner versions:

Scanner	Base tree	Tuned	Tuning
zizmor 1.30.0	78 HIGH, 11 workflows	0 findings	none: #392 deleted nine upstream workflows, this pins the two left
bandit 1.9.4	4 HIGH, 9,883 total	0 HIGH, 1,697 total	skip B101 under tests only (pytest asserts would bury the weekly upload); exclude 4 upstream files with reviewed false-positive HIGHs
trivy 0.70.0	5 HIGH	0 HIGH	skip upstream's four CUDA Dockerfiles; Dockerfile.rocm stays scanned
gitleaks 8.30.1	2,013 (all refs incl. upstream/main)	0	dtype/kwarg value classes, a *_sha256 line rule, kernel-vocabulary stopwords — all scoped to generic-api-key

Two baseline defects fixed along the way: bandit matches exclude_dirs entries as bare substrings, so the baseline's build silently dropped build_backend_rocm.py and 16 other files; and the baseline's digest allowlist suppressed every gitleaks rule on a matching line.

The gitleaks tuning is words, not shapes: a segment-shape regex was tried first and passed 37–61% of random prod_<12>_<12> keys. The stopwords suppress ~0.01% of random 32-char keys, and a fake-secret probe file is flagged 6/6 by both the tuned and the default config.

Test plan

• pre-commit run -a (incl. actionlint with shellcheck; a probe workflow fails it)
• bandit / trivy / zizmor / gitleaks locally at the pinned versions, as tabled; trivy A/B with the untuned config: 5 HIGH → 0
• test_repo_workflows.py A/B: passes on this tree, fails with claude-code-review.yml added or pre-commit.yml removed (run directly; host has no pytest — CI runs it in the conformance lane)
• On this PR: Security scan / Security scanners, pre-commit, conformance green; the findings bot reports no critical/high findings
• CodeQL legs, forced with a temporary commit (since dropped): python 6m27s, c-cpp 1m43s (buildless, 98 queries), actions ~1m — all pass. .cu files are classified as Cuda and never analysed; only .h/.cpp reach the c-cpp leg
• No runtime, kernel or build path touched: no benchmark applies; gfx942 and gfx950 identical

[github-actions]

Security scan found no critical or high findings on lines changed by this pull request

View the security scan run for complete reports.

“New” means the finding is located in a changed file on an added or modified line; it is not a base-versus-head findings delta.

[Copilot]

🔵 Needs a closer look

Scanner suppressions and delegated workflow permissions warrant final maintainer validation.

No open issues 🎉

What changed in this PR

Adds AMD’s security-scanning baseline to the ROCm fork, building on the governance changes in #392 without changing runtime or kernel code.

Changes:

• Adds PR and weekly security scans with repository-specific scanner configurations.
• Hardens workflows with SHA pins and limited permissions; adds Dependabot and validation hooks.
• Adds a workflow-set guard to prevent upstream automation returning during syncs.

File	Description
tests/​rocm/​test_repo_workflows.py	Enforces the fork-owned workflow set.
tests/​rocm/​test_redistribution_licences.py	Updates comments about upstream workflows.
SECURITY.md	Defines private vulnerability reporting and scope.
README.md	Adds contributing and security sections.
CONTRIBUTING.md	Documents governance, reporting, and fork-owned sync rules.
.pre-commit-config.yaml	Adds YAML, JSON, and Actions validation.
.github/​workflows/​weekly-security-scan.yml	Adds scheduled scans and SARIF uploads.
.github/​workflows/​update-codeowners.yml	Removes upstream ownership automation.
.github/​workflows/​release.yml	Removes upstream release automation.
.github/​workflows/​release-ci-docker.yml	Removes upstream CUDA image publishing.
.github/​workflows/​pre-commit.yml	Pins actions and hardens permissions and triggers.
.github/​workflows/​pr-test.yml	Removes upstream NVIDIA test automation.
.github/​workflows/​pr-security-scan.yml	Adds PR security scans and reports.
.github/​workflows/​pr-api-doc-comment.yml	Removes upstream documentation reporting.
.github/​workflows/​pr-api-doc-checks.yml	Removes upstream documentation checks.
.github/​workflows/​nightly-release.yml	Removes upstream nightly publishing.
.github/​workflows/​new-issue.yml	Removes upstream issue triage automation.
.github/​workflows/​build-doc.yml	Removes upstream documentation deployment.
.github/​workflows/​arch-caps-conformance.yml	Hardens actions and runs the workflow-set guard.
.github/​scan_tools_configs/​zizmor.yml	Adds workflow-security scanner configuration.
.github/​scan_tools_configs/​trivy.yml	Excludes unused upstream CUDA Dockerfiles.
.github/​scan_tools_configs/​gitleaks.toml	Tunes secret-scanning allowlists.
.github/​scan_tools_configs/​bandit.yml	Configures exclusions and test-assert handling.
.github/​ISSUE_TEMPLATE/​feature_request.yml	Requests ROCm environment details.
.github/​ISSUE_TEMPLATE/​bug_report.yml	Replaces CUDA diagnostics with ROCm details.
.github/​dependabot.yml	Adds grouped Actions dependency updates.
.github/​CODEOWNERS	Routes ownership to the fork maintainer.
.claude/​skills/​code-coverage/​SKILL.md	Updates documentation about CPU-only CI.

_{Review effort: Balanced}