feat(security): onboard pre-commit and Pulse secret scanning

[gmanal]

Description

Onboard NVIDIA secret scanning to cuda-python using the centrally maintained NVIDIA/security-workflows surfaces. Two complementary controls:

• Local (advisory):secret-scan-trufflehog pre-commit hook — catches credentials before commit.
• CI (enforcement): the Pulse reusable workflow — server-side scan on trusted branches that blocks on verified secrets.

Changes

• Add .github/workflows/secret-scan-pulse.yml calling the centralized Pulse reusable workflow, on main, ctk-next, and copy-pr-bot pull-request/* branches; runs on nv-cpu-general (onboarded for this repo in the enterprise runner config).
• Add the secret-scan-trufflehog pre-commit hook (pinned to security-workflowsv0.1.0), skipped on hosted pre-commit.ci which lacks the trufflehog binary.
• Set failure_policy: unverified explicitly (fail on verified/live secrets, warn on unverified); fails closed on scanner/infra errors.
• Pin per policy: pre-commit rev to release tag v0.1.0, workflow uses: to a reviewed commit SHA.
• Document local setup and testing in CONTRIBUTING.md.

Checklist

• New or existing tests cover these changes.
• The documentation is up to date with these changes.

[github-actions]

Doc Preview CI
🚀 View preview at https://nvidia.github.io/cuda-python/pr-preview/pr-2405/
https://nvidia.github.io/cuda-python/pr-preview/pr-2405/cuda-core/
https://nvidia.github.io/cuda-python/pr-preview/pr-2405/cuda-bindings/
https://nvidia.github.io/cuda-python/pr-preview/pr-2405/cuda-pathfinder/
Preview will be ready when the GitHub Pages deployment is complete.

[mdboom]

Blocked by #2327 so that Windows developers can install pre-commit locally (and get the advantage of this here).

[mdboom]

Blocked by #2327 so that Windows developers can install pre-commit locally (and get the advantage of this here).

Given an offline discussion, this does not need to be blocked on #2327.

[kkraus14]

Can we not require Git Bash on Windows? Given the pre-commit hook is mostly just downloading the correct platform binary to use, I imagine we can implement it in a way that doesn't add any extra dependencies for developers?

[gmanal]

Good call.
as hook detects OS/arch, downloads a pinned TruffleHog release, verifies its SHA-256, caches it, and execs it. None of that needs a shell and can be achieved using python script as well.

The fix will be to move the wrapper to language: python. pre-commit is itself Python, so an interpreter is guaranteed on every platform, and the whole thing is stdlib: platform for arch detection, urllib.request to download, hashlib to verify, tarfile/zipfile to extract.
No Git Bash, no curl, no extra dependencies on any OS.

Do you want to hold this PR for this change? or can we move and add it later.

[kkraus14]

I've opened NVIDIA/security-workflows#14 to address this upstream

[gmanal]

Closing in favor of #2589, which supersedes this PR.

#2589 does everything here — the secret-scan-trufflehog pre-commit hook and the server-side Pulse secret scan with failure_policy: unverified — but routes them through the security-workflowssecurity suite: one pinned reference instead of one caller per scan. Beyond that it enables CodeQL SAST and retires this repo's codeql.yml, because both publish under /language:python and two analyses on the same commit overwrite each other's alerts. The suite runs the same analysis the retired workflow did: python, build-mode: none, security-extended.

@kkraus14 — your Git Bash question is resolved. The hook moved to language: python and installs the pinned, SHA-256-verified binary into pre-commit's own environment (NVIDIA/security-workflows#14, shipped in v0.3.0). No Git Bash, no curl, no extra developer dependencies; verified on Linux, macOS, and Windows across x86_64 and arm64. #2589 pins v0.3.0 and drops the Git Bash line from CONTRIBUTING.

@mdboom@rparolin — thanks for the reviews here. The SHA-pinning and CONTRIBUTING feedback both carried into #2589, and I've left a comment there summarising exactly what differs from this PR.