ci: enable secret-scan-trufflehog pre-commit hook

[mc-nv]

Description

Enables the NVIDIA secret-scan-trufflehog pre-commit hook, pinned to v0.3.0,
as the first entry under repos: so scanning runs before any formatter rewrites
the working tree.

This adopts the centrally maintained hook published by NVIDIA/security-workflows
rather than a hand-rolled TruffleHog invocation, so the scanner version and its
per-platform checksums are bumped in one reviewed place instead of 27.

v0.3.0 is pinned deliberately. It installs the scanner inside pre-commit's own
Python environment — removing the shell installer, so Windows works without Git
Bash — and it adds --exclude-detectors=lob. That exclusion matters here: a Lob
API key is test_ followed by 35 characters, so the detector matches ordinary
pytest function names such as test_gpu_conf_compute_attestation_report, and
Lob's verifier reports them as verified — the one result class this hook fails
on.

Behaviour: scans only the files pre-commit supplies (staged files at commit time,
the push range at push time), reports verified secrets only, and fails closed on
a finding.

Deliberately out of scope:

• No ci: skip: block. That is prescribed for the hosted pre-commit.ci sandbox,
  which has no network access. No Triton repo uses pre-commit.ci — CI runs
  pre-commit from .github/workflows/pre-commit.yml — so it would be dead config.
• No default_install_hook_types change. Activation is a developer action;
  changing that key would alter install behaviour for every hook in the repo,
  not just this one. Tracked separately.

Changes

• Add NVIDIA/security-workflows secret-scan-trufflehog @ v0.3.0 as the
  first entry under repos:.

Affected Files

• .pre-commit-config.yaml

Test plan

• pre-commit validate-config — passes.
• pre-commit run secret-scan-trufflehog --all-files — passes, with zero
  pre-existing verified secrets, so CI does not break on merge.
• TruffleHog 3.95.9 confirmed installed into pre-commit's Python environment
  and executed, so the hook is functional rather than a silent no-op.
• Blast radius is bounded: .github/workflows/pre-commit.yml runs
  pre-commit run --files against PR-modified paths only, never --all-files.

Caveats

Editing the config alone scans nothing. Each contributor must run once per clone:

pre-commit install --hook-type pre-commit
pre-commit install --hook-type pre-push

Without the second, the pre-push stage stays dormant.

Related PRs

• ci: enable secret-scan-trufflehog pre-commit hook server#8929
• ci: enable secret-scan-trufflehog pre-commit hook core#521
• ci: enable secret-scan-trufflehog pre-commit hook common#163
• ci: enable secret-scan-trufflehog pre-commit hook backend#128
• ci: enable secret-scan-trufflehog pre-commit hook client#916
• ci: enable secret-scan-trufflehog pre-commit hook python_backend#452
• ci: enable secret-scan-trufflehog pre-commit hook pytorch_backend#206
• ci: enable secret-scan-trufflehog pre-commit hook onnxruntime_backend#356
• ci: enable secret-scan-trufflehog pre-commit hook openvino_backend#120
• ci: enable secret-scan-trufflehog pre-commit hook tensorrt_backend#126
• ci: enable secret-scan-trufflehog pre-commit hook tensorrtllm_backend#862
• ci: enable secret-scan-trufflehog pre-commit hook vllm_backend#136
• ci: enable secret-scan-trufflehog pre-commit hook fil_backend#459
• ci: enable secret-scan-trufflehog pre-commit hook identity_backend#37
• ci: enable secret-scan-trufflehog pre-commit hook repeat_backend#20
• ci: enable secret-scan-trufflehog pre-commit hook square_backend#23
• ci: enable secret-scan-trufflehog pre-commit hook model_analyzer#1033
• ci: enable secret-scan-trufflehog pre-commit hook perf_analyzer#468
• ci: enable secret-scan-trufflehog pre-commit hook triton_cli#128
• ci: enable secret-scan-trufflehog pre-commit hook local_cache#17
• ci: enable secret-scan-trufflehog pre-commit hook checksum_repository_agent#15
• ci: enable secret-scan-trufflehog pre-commit hook developer_tools#62
• ci: enable secret-scan-trufflehog pre-commit hook third_party#81
• ci: enable secret-scan-trufflehog pre-commit hook tutorials#166

Also part of this rollout, on internal GitLab: dl/dgx/tritonserver!1853 and dl/dgx/tritonmodelanalyzer!181.

Related Issues

• Resolves: TRI-1701

[greptile-apps]

Greptile Summary

Adds NVIDIA’s centrally maintained TruffleHog secret-scanning hook to the pre-commit configuration.

• Pins NVIDIA/security-workflows to v0.3.0.
• Places secret scanning before formatting hooks.
• Uses the hook’s supplied defaults for stages, file handling, and verified-secret detection.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete blocking or non-blocking issues identified in the configuration change.

The added hook declaration is narrowly scoped, deliberately pinned, and the provided validation confirms that the configuration initializes and executes the intended scanner.

Important Files Changed

Filename	Overview
.pre-commit-config.yaml	Adds the pinned secret-scan-trufflehog hook as the first repository entry; no actionable defect was established.

_{Reviews (1): Last reviewed commit: "ci: enable secret-scan-trufflehog pre-co..." | Re-trigger Greptile}