security: remove old implementation of gitleaks and add all scanners

.github/workflows/security_scan_pr.yml

@@ -0,0 +1,27 @@
+# Copyright Advanced Micro Devices, Inc.
+# SPDX-License-Identifier: MIT
+#
+# PR-time security scan. Requests human-readable reports only: findings are
+# uploaded as a build artifact and printed to the job summary, never to the
+# Security tab, so fork PRs (which never receive elevated tokens) behave
+# identically to same-repo PRs. See the scheduled counterpart
+# (security_scan_weekly.yml) for the SARIF / code-scanning upload.
+
+name: Security scan (PR)
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  security:
+    name: Security scan
+    uses: ROCm/rocm-security-gh/.github/workflows/security-baseline.yml@cc668a725f81b3bc5af72e47ebecabf92f25066d # v1.0.1
+    with:
+      report_formats: human
+      bandit_config_path: build_tools/scan_tools/bandit.yaml
+      gitleaks_config_path: build_tools/scan_tools/gitleaks.toml
+      trivy_config_path: build_tools/scan_tools/trivy.yaml
+      zizmor_config_path: build_tools/scan_tools/zizmor.yaml

.github/workflows/security_scan_weekly.yml

@@ -0,0 +1,34 @@
+# Copyright Advanced Micro Devices, Inc.
+# SPDX-License-Identifier: MIT
+#
+# Trusted security scan: full-repo scan (scan_mode: all) with SARIF results
+# uploaded to the Security tab. `security-events: write` is granted on the
+# `uses:` job itself, not just the top-level `permissions:` block above it,
+# since a `permissions:` block (wherever declared) implicitly zeroes out
+# anything it doesn't list. See the PR-time counterpart
+# (security_scan_pr.yml) for the human-readable, non-elevated variant.
+
+name: Weekly security scan
+
+on:
+  schedule:
+    - cron: "0 10 * * 6"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  security:
+    name: Security scan
+    permissions:
+      contents: read
+      security-events: write
+    uses: ROCm/rocm-security-gh/.github/workflows/security-baseline.yml@cc668a725f81b3bc5af72e47ebecabf92f25066d # v1.0.1
+    with:
+      scan_mode: all
+      report_formats: sarif
+      bandit_config_path: build_tools/scan_tools/bandit.yaml
+      gitleaks_config_path: build_tools/scan_tools/gitleaks.toml
+      trivy_config_path: build_tools/scan_tools/trivy.yaml
+      zizmor_config_path: build_tools/scan_tools/zizmor.yaml

.github/workflows/unit_tests.yml

@@ -48,10 +48,6 @@ jobs:
         python -m pytest -vv --durations=20 \
           --cov --cov-report=term-missing --cov-report=html
 
-    - name: Test scan_tools
-      working-directory: build_tools/scan_tools
-      run: python -m pytest -vv --durations=20
-
     - name: Test test_tools
       working-directory: test_tools
       run: python -m pytest -vv --durations=20

TESTING.md

@@ -232,7 +232,7 @@ ______________________________________________________________________
 We use [GitHub Actions](https://github.com/features/actions) in the
 [`.github/workflows`](/.github/workflows/) directory for a variety of workflows:
 
-- Lightweight checks: codeql.yml, gitleaks.yml, pre-commit.yml, unit_tests.yml, therock-pr-bot.yml, etc.
+- Lightweight checks: codeql.yml, security_scan_pr.yml, pre-commit.yml, unit_tests.yml, therock-pr-bot.yml, etc.
 - CI/CD workflows: multi_arch_ci.yml, multi_arch_release.yml, etc.
 - Other automation: bump_submodules.yml, copy_release.yml, publish_build_manylinux_x86_64.yml
 

build_tools/github_actions/configure_ci_path_filters.py

@@ -216,8 +216,7 @@ def is_ci_run_required(paths: Optional[Iterable[str]]) -> bool:
     ".github/dependabot.yml",
     "*CODEOWNERS",
     "*LICENSE",
-    # Files used by gitleaks, no impact on CI.
-    "gitleaks.toml",
+    # Scanner configs consumed by the security scan workflows, no impact on CI.
     "build_tools/scan_tools/*",
     # Changes to dockerfiles do not currently affect CI workflows directly.
     # Docker images are built and published after commits are pushed, then
@@ -241,7 +240,6 @@ def is_ci_run_required(paths: Optional[Iterable[str]]) -> bool:
     "build_tools/packaging/linux/tests/*",
     "build_tools/packaging/python/tests/*",
     "build_tools/third_party/s3_management/tests/*",
-    "build_tools/scan_tools/github_actions/tests/*",
     "test_tools/tests/*",
 ]