feat(security): onboard pre-commit and Pulse secret scanning

.github/workflows/secret-scan-pulse.yml

@@ -0,0 +1,43 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# CI secret-scan enforcement via NVIDIA/security-workflows (Pulse).
+# Local advisory scanning is the secret-scan-trufflehog pre-commit hook.
+# Pinned to a reviewed commit SHA; bump when NVIDIA/security-workflows consolidates.
+
+name: Secret Scan (Pulse)
+
+on:
+  push:
+    branches:
+      - main
+      - ctk-next
+      # copy-pr-bot mirror branches — trusted PR execution context
+      - "pull-request/[0-9]+"
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-on-${{ github.event_name }}-from-${{ github.ref_name }}
+  cancel-in-progress: true
+
+# Caller permissions must cover the reusable workflow (intersection applies).
+permissions:
+  contents: read
+  id-token: write          # OIDC -> Vault -> nvcr.io image pull
+  security-events: write   # publish redacted SARIF to code scanning
+  actions: read            # required by upload-sarif
+
+jobs:
+  secret-scan:
+    name: Secret Scan
+    # Pulse needs nv-gha-runners + Vault/nvcr vars; skip on forks.
+    if: github.repository == 'NVIDIA/cuda-python'
+    uses: NVIDIA/security-workflows/.github/workflows/secret-scan-pulse.yml@69032f641c3c34e0c0b46f636b54ed2b101b7aa4
+    with:
+      runs-on: linux-amd64-cpu4
+      # Set failure_policy explicitly so enforcement can't drift with upstream defaults.
+      #   unverified — fail on verified/live secrets (183); warn on unverified (185)  [default]
+      #   strict     — fail on any finding (verified or unverified)
+      #   all        — warn only; never fail the job on findings
+      failure_policy: unverified

.pre-commit-config.yaml

@@ -9,12 +9,20 @@ ci:
     autoupdate_branch: ''
     autoupdate_commit_msg: '[pre-commit.ci] pre-commit autoupdate'
     autoupdate_schedule: quarterly
-    skip: [lychee, check-precommit-installed]
+    skip: [lychee, check-precommit-installed, secret-scan-trufflehog]
     submodules: false
 
 # Please update the rev: SHAs below with this command:
 # pre-commit autoupdate --freeze
 repos:
+  # Runs first so a leaked credential blocks the commit before any formatter runs.
+  # Requires `trufflehog` on $PATH; the wrapper prints install commands if missing.
+  # Skipped on pre-commit.ci (no trufflehog binary in that sandbox); Pulse CI enforces server-side.
+  - repo: https://github.com/NVIDIA/security-workflows
+    rev: v0.1.0
+    hooks:
+      - id: secret-scan-trufflehog
+
   - repo: https://github.com/astral-sh/ruff-pre-commit
     rev: c60c980e561ed3e73101667fe8365c609d19a438  # frozen: v0.15.9
     hooks:

CONTRIBUTING.md

@@ -75,6 +75,16 @@ If the hook isn't installed, `pre-commit run` (and CI) will print a visible
 warning reminding you to run `pre-commit install`.
 
 
+## Secret Scanning
+
+Two complementary controls prevent accidental credential leakage:
+
+- **Local pre-commit** (`secret-scan-trufflehog`, via `.pre-commit-config.yaml`): catches credentials before commit. Requires `trufflehog` on your PATH (the wrapper prints install commands if missing). Never commit a flagged secret; check with maintainers on false positives, and only use `git commit --no-verify` in exceptional, agreed cases.
+- **Server-side enforcement** (Pulse reusable workflow from `NVIDIA/security-workflows`, pinned by SHA): runs on `main`, `ctk-next`, and trusted copy-pr-bot branches, and blocks merges on verified secrets.
+
+The local hook is skipped on hosted pre-commit.ci (no `trufflehog` binary there); Pulse remains the authoritative CI enforcement.
+
+
 ## Signing Your Work
 
 Contributions to files licensed under Apache 2.0 must be certified under the