ci: enable secret-scan-trufflehog pre-commit hook

[mc-nv]

Description

Enables the NVIDIA secret-scan-trufflehog pre-commit hook, pinned to v0.3.0,
as the first entry under repos: so scanning runs before any formatter rewrites
the working tree.

This adopts the centrally maintained hook published by NVIDIA/security-workflows
rather than a hand-rolled TruffleHog invocation, so the scanner version and its
per-platform checksums are bumped in one reviewed place instead of 27.

v0.3.0 is pinned deliberately. It installs the scanner inside pre-commit's own
Python environment — removing the shell installer, so Windows works without Git
Bash — and it adds --exclude-detectors=lob. That exclusion matters here: a Lob
API key is test_ followed by 35 characters, so the detector matches ordinary
pytest function names such as test_gpu_conf_compute_attestation_report, and
Lob's verifier reports them as verified — the one result class this hook fails
on.

Behaviour: scans only the files pre-commit supplies (staged files at commit time,
the push range at push time), reports verified secrets only, and fails closed on
a finding.

Deliberately out of scope:

• No ci: skip: block. That is prescribed for the hosted pre-commit.ci sandbox,
  which has no network access. No Triton repo uses pre-commit.ci — CI runs
  pre-commit from .github/workflows/pre-commit.yml — so it would be dead config.
• No default_install_hook_types change. Activation is a developer action;
  changing that key would alter install behaviour for every hook in the repo,
  not just this one. Tracked separately.

Changes

• Add NVIDIA/security-workflows secret-scan-trufflehog @ v0.3.0 as the
  first entry under repos:.

Affected Files

• .pre-commit-config.yaml

Test plan

• pre-commit validate-config — passes.
• pre-commit run secret-scan-trufflehog --all-files — passes, with zero
  pre-existing verified secrets, so CI does not break on merge.
• TruffleHog 3.95.9 confirmed installed into pre-commit's Python environment
  and executed, so the hook is functional rather than a silent no-op.
• Blast radius is bounded: .github/workflows/pre-commit.yml runs
  pre-commit run --files against PR-modified paths only, never --all-files.

Caveats

Editing the config alone scans nothing. Each contributor must run once per clone:

pre-commit install --hook-type pre-commit
pre-commit install --hook-type pre-push

Without the second, the pre-push stage stays dormant.

Related PRs

• ci: enable secret-scan-trufflehog pre-commit hook server#8929
• ci: enable secret-scan-trufflehog pre-commit hook core#521
• ci: enable secret-scan-trufflehog pre-commit hook common#163
• ci: enable secret-scan-trufflehog pre-commit hook backend#128
• ci: enable secret-scan-trufflehog pre-commit hook python_backend#452
• ci: enable secret-scan-trufflehog pre-commit hook pytorch_backend#206
• ci: enable secret-scan-trufflehog pre-commit hook onnxruntime_backend#356
• ci: enable secret-scan-trufflehog pre-commit hook openvino_backend#120
• ci: enable secret-scan-trufflehog pre-commit hook tensorrt_backend#126
• ci: enable secret-scan-trufflehog pre-commit hook tensorrtllm_backend#862
• ci: enable secret-scan-trufflehog pre-commit hook vllm_backend#136
• ci: enable secret-scan-trufflehog pre-commit hook fil_backend#459
• ci: enable secret-scan-trufflehog pre-commit hook identity_backend#37
• ci: enable secret-scan-trufflehog pre-commit hook repeat_backend#20
• ci: enable secret-scan-trufflehog pre-commit hook square_backend#23
• ci: enable secret-scan-trufflehog pre-commit hook model_analyzer#1033
• ci: enable secret-scan-trufflehog pre-commit hook perf_analyzer#468
• ci: enable secret-scan-trufflehog pre-commit hook triton_cli#128
• ci: enable secret-scan-trufflehog pre-commit hook local_cache#17
• ci: enable secret-scan-trufflehog pre-commit hook redis_cache#25
• ci: enable secret-scan-trufflehog pre-commit hook checksum_repository_agent#15
• ci: enable secret-scan-trufflehog pre-commit hook developer_tools#62
• ci: enable secret-scan-trufflehog pre-commit hook third_party#81
• ci: enable secret-scan-trufflehog pre-commit hook tutorials#166

Also part of this rollout, on internal GitLab: dl/dgx/tritonserver!1853 and dl/dgx/tritonmodelanalyzer!181.

Related Issues

• Resolves: TRI-1701

[greptile-apps]

Greptile Summary

Adds the centrally maintained NVIDIA TruffleHog pre-commit hook, pinned to v0.3.0, ahead of the repository’s formatting hooks.

• Enables verified-secret scanning through NVIDIA/security-workflows.
• Leaves existing pre-commit installation and CI workflow behavior unchanged.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete changed-code failure established.

The configuration adds a pinned secret-scanning hook without changing existing hooks or workflow settings, and the available repository evidence does not demonstrate a reachable build, runtime, or scanning-coverage defect caused by this change.

Important Files Changed

Filename	Overview
.pre-commit-config.yaml	Adds the pinned secret-scan-trufflehog hook as the first configured repository; no actionable defect was established.

_{Reviews (1): Last reviewed commit: "ci: enable secret-scan-trufflehog pre-co..." | Re-trigger Greptile}