security: remove old implementation of gitleaks and add all scanners

.github/workflows/security_scan_pr.yml

@@ -0,0 +1,32 @@
+# Copyright Advanced Micro Devices, Inc.
+# SPDX-License-Identifier: MIT
+#
+# PR-time security scan. Requests human-readable reports only: findings are
+# uploaded as a build artifact and printed to the job summary, never to the
+# Security tab, so fork PRs (which never receive elevated tokens) behave
+# identically to same-repo PRs. See the scheduled counterpart
+# (security_scan_weekly.yml) for the SARIF / code-scanning upload.
+
+name: Security scan (PR)
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  security:
+    name: Security scan
+    uses: ROCm/rocm-security-gh/.github/workflows/security-baseline.yml@3a1bd0da89771757df435817daae14d1635b7fdb # v1.0.1
+    with:
+      report_formats: human
+      bandit_config_path: build_tools/scan_tools/bandit.yml
+      codeql_config_path: build_tools/scan_tools/codeql.yml
+      gitleaks_config_path: build_tools/scan_tools/gitleaks.toml
+      trivy_config_path: build_tools/scan_tools/trivy.yml
+      zizmor_config_path: build_tools/scan_tools/zizmor.yml

.github/workflows/security_scan_weekly.yml

@@ -0,0 +1,35 @@
+# Copyright Advanced Micro Devices, Inc.
+# SPDX-License-Identifier: MIT
+#
+# Trusted security scan: full-repo scan (scan_mode: all) with SARIF results
+# uploaded to the Security tab. `security-events: write` is granted on the
+# `uses:` job itself, not just the top-level `permissions:` block above it,
+# since a `permissions:` block (wherever declared) implicitly zeroes out
+# anything it doesn't list. See the PR-time counterpart
+# (security_scan_pr.yml) for the human-readable, non-elevated variant.
+
+name: Security scan (Weekly)
+
+on:
+  schedule:
+    - cron: "0 10 * * 6"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  security:
+    name: Security scan
+    permissions:
+      contents: read
+      security-events: write
+    uses: ROCm/rocm-security-gh/.github/workflows/security-baseline.yml@3a1bd0da89771757df435817daae14d1635b7fdb # v1.0.1
+    with:
+      scan_mode: all
+      report_formats: sarif
+      bandit_config_path: build_tools/scan_tools/bandit.yml
+      codeql_config_path: build_tools/scan_tools/codeql.yml
+      gitleaks_config_path: build_tools/scan_tools/gitleaks.toml
+      trivy_config_path: build_tools/scan_tools/trivy.yml
+      zizmor_config_path: build_tools/scan_tools/zizmor.yml

.github/workflows/unit_tests.yml

@@ -48,10 +48,6 @@ jobs:
         python -m pytest -vv --durations=20 \
           --cov --cov-report=term-missing --cov-report=html
 
-    - name: Test scan_tools
-      working-directory: build_tools/scan_tools
-      run: python -m pytest -vv --durations=20
-
     - name: Test test_tools
       working-directory: test_tools
       run: python -m pytest -vv --durations=20

CONTRIBUTING.md

@@ -220,6 +220,7 @@ following standards:
 | ✅ Pull requests should link an issue | <ul><li>[`therock-pr-bot.yml`](/.github/workflows/therock-pr-bot.yml)</li></ul>                                                              | <ul><li>[`pull_request_template.md`](/.github/pull_request_template.md)<li>Policy Bot [`FAQ.md`](/skills/therock_pr_bot/FAQ.md#-pr-description)</li></ul> |
 | ✅ Lint pre-commit checks             | <ul><li>[`pre-commit.yml`](.github/workflows/pre-commit.yml)</li></ul>                                                                       | <ul><li>[pre-commit checks](#pre-commit-checks)</li></ul>                                                                                                 |
 | ✅ Changes should be tested           | <ul><li>[`unit_tests.yml`](.github/workflows/unit_tests.yml)</li><li>[`therock-pr-bot.yml`](/.github/workflows/therock-pr-bot.yml)</li></ul> | <ul><li>[`TESTING.md`](/TESTING.md)</li><li>[`docs/development/adding_tests.md`](docs/development/adding_tests.md)</li></ul>                              |
+| ✅ Security scans                     | <ul><li>[`security_scan_pr.yml`](/.github/workflows/security_scan_pr.yml)</li></ul>                                                          | <ul><li>[Security scanners](#security-scanners)</li></ul>                                                                                                 |
 
 > [!NOTE]
 > For more information about the PR Policy Bot which enforces some of these
@@ -308,6 +309,55 @@ The `lychee` hook checks that repo-relative markdown links resolve to files that
 exist. It is confined to the `manual` stage because it downloads a `lychee`
 binary on first run, which the other hooks do not need.
 
+#### Security scanners
+
+Separately from the correctness checks above, we scan the repository for
+secrets, unsafe Python, workflow vulnerabilities, and image
+misconfigurations. These run in CI via
+[`security_scan_pr.yml`](/.github/workflows/security_scan_pr.yml), which calls
+the shared [`ROCm/rocm-security-gh`](https://github.com/ROCm/rocm-security-gh)
+reusable workflow. See
+[the security scanning section in `TESTING.md`](/TESTING.md#therock-feature-area-security-scanning)
+for how the two security workflows fit together.
+
+Each scanner is runnable locally against the same configuration CI uses, which
+is faster than pushing a commit to see what CI says. The configurations live in
+[`build_tools/scan_tools/`](/build_tools/scan_tools/):
+
+```bash
+# Secrets, over the full git history (installed separately, see gitleaks docs).
+gitleaks detect --source . --config build_tools/scan_tools/gitleaks.toml \
+  --redact --verbose --no-banner
+
+# Secrets, working tree only. Much faster, and usually what you want locally.
+gitleaks detect --source . --config build_tools/scan_tools/gitleaks.toml \
+  --redact --no-banner --no-git
+
+# Unsafe patterns in Python (pip install bandit).
+bandit --configfile build_tools/scan_tools/bandit.yml --severity-level low \
+  --recursive .
+
+# GitHub Actions workflow vulnerabilities (pip install zizmor).
+zizmor --persona regular --config build_tools/scan_tools/zizmor.yml .
+
+# Dockerfile misconfigurations and dependency vulnerabilities (see trivy docs).
+trivy fs --config build_tools/scan_tools/trivy.yml \
+  --severity LOW,MEDIUM,HIGH,CRITICAL --scanners misconfig,vuln .
+```
+
+> [!NOTE]
+> These commands report every severity, while CI only fails on `HIGH` (and
+> `CRITICAL` for trivy). Expect more output locally than a red CI check implies.
+>
+> The commands also scan the whole repository, while pull request runs default
+> to scanning only what the pull request changed. A full-history `gitleaks` run
+> in particular reports pre-existing findings that the pull request check does
+> not.
+
+CodeQL is not in the list above because it needs the CodeQL CLI and a built
+database; it runs in CI only, configured by
+[`build_tools/scan_tools/codeql.yml`](/build_tools/scan_tools/codeql.yml).
+
 #### Requesting a code review
 
 If you are not looking for a review on a pull request yet, please mark that pull