Secret scaner workflow

[JanuszL]

Category:

Description:

Additional information:

Affected modules and functionalities:

Key points relevant for the review:

Tests:

• Existing tests apply
• New tests added
  • Python tests
  • GTests
  • Benchmark
  • Other
• N/A

Checklist

Documentation

• Existing documentation applies
• Documentation updated
  • Docstring
  • Doxygen
  • RST
  • Jupyter
  • Other
• N/A

DALI team only

Requirements

• Implements new requirements
• Affects existing requirements
• N/A

REQ IDs: N/A

JIRA TASK: N/A

[greptile-apps]

Greptile Summary

This PR adds local and CI secret scanning.

• Runs a TruffleHog-based pre-commit check before the existing copyright validation.
• Adds a reusable secret-scan workflow for pull-request mirror branches.
• Configures the NVIDIA security-workflows pre-commit hook.

Confidence Score: 4/5

The PR appears safe to merge, though the local executable hook should be pinned to an immutable commit to reduce supply-chain exposure.

The secret-scanning paths are coherent, but the local pre-commit configuration has weaker dependency pinning than the CI path for the same upstream repository.

Files Needing Attention: .pre-commit-config.yaml

Security Review

The local hook is referenced through a mutable tag even though it executes downloaded code on developer machines; pinning it to the reviewed commit would align it with the CI workflow.

Important Files Changed

Filename	Overview
.githooks/pre-commit	Adds mandatory invocation of the configured secret-scanning hook before the existing copyright check.
.github/workflows/security.yml	Adds a narrowly scoped reusable secret-scanning workflow with an immutable upstream workflow reference.
.pre-commit-config.yaml	Adds the TruffleHog secret scanner but references executable upstream code through a mutable version tag.

_{Reviews (1): Last reviewed commit: "Adjust events" | Re-trigger Greptile}

[greptile-apps]

Mutable local hook revision

The new pre-commit configuration executes code from the mutable v0.2.0 tag on developer machines, allowing later tag retargeting to substitute code that was not reviewed here. Pin this hook to an immutable commit, as the workflow does for the same upstream repository.

Suggested change

	rev: v0.2.0
	rev: 031c5429271b5692e025c3e292fcc2bf11e116f7