NVIDIA/security-workflows v0.2.0

v0.2.0 — Self-installing secret-scan pre-commit hook

Repository: NVIDIA/security-workflows

Tag: v0.2.0

Published: 2026-07-24T04:49:09Z

Prerelease: no

Release notes:

v0.2.0 — Self-installing secret-scan pre-commit hook

This release makes the secret-scan-trufflehog pre-commit hook install nothing manually. On first use it fetches a pinned, checksum-verified TruffleHog release into a per-user cache and reuses it thereafter — the same "it just works" experience contributors expect from hooks like clang-format. The CI (Pulse) surface is unchanged.

Why this matters

• Zero-setup for contributors. No brew install / curl | sh / PATH juggling — the hook provisions its own pinned scanner on the first commit.
• Cross-platform. Linux, macOS, and Windows (via Git Bash/MSYS), on both amd64 and arm64.
• Supply-chain safe. The binary is downloaded over HTTPS and verified against a per-platform SHA-256 pinned from TruffleHog's cosign-signed checksums.txt; the hook fails closed on any mismatch and never executes an unverified binary.

What changed since v0.1.0

• The secret-scan-trufflehog hook wrapper now self-installs TruffleHog 3.95.9:
• Downloads the official release archive for the detected OS/arch.
• Verifies it against a pinned SHA-256 (fail-closed).
• Caches it under ${XDG_CACHE_HOME:-~/.cache}/nvidia-security-workflows/trufflehog// and reuses it offline on subsequent runs.
• Added Windows support (Git Bash/MSYS) alongside Linux and macOS.
• Documentation updated; the previous, incorrect manual-install guidance (pip install trufflehog, which resolves to a deprecated unrelated tool) has been removed.

Compatibility

• Drop-in for existing consumers. The hook id, arguments (--results=verified), stages, and default behavior are unchanged — only how the binary is obtained changed.
• No CI/workflow change. The Pulse reusable workflow (secret-scan-pulse.yml) and its failure_policy model are identical to v0.1.0.

Requirements (new)

• Network access to github.com on the first run per version (subsequent runs are offline).
• curl or wget, tar, and sha256sum/shasum available — standard on Linux/macOS and bundled with Git for Windows.
• Windows contributors must run within a Git Bash/MSYS environment.

How to upgrade

Bump the pre-commit pin from v0.1.0 to v0.2.0 in your .pre-commit-config.yaml:

repos:
- repo: https://github.com/NVIDIA/security-workflows
rev: v0.2.0
hooks:
- id: secret-scan-trufflehog

The reusable-workflow uses: pin (by commit SHA) is unaffected by this release.

Pinning policy (unchanged)

• Pre-commit `rev:` -> release tag (this tag, v0.2.0).
• Workflow `uses:` -> 40-character commit SHA.

Full detail in CHANGELOG.md. Pre-1.0: interfaces may still change in a minor release while the surfaces stabilize with ProdSec.