ci: enable the Pulse vulnerability and malware scans in the Security Suite

Turns on `enable-vuln-scan` and `enable-malware-scan` and repins the suite to
NVIDIA/security-workflows test/vuln-malware-onboarding, the branch carrying the
0.5.0 release notes for both scans.

The vulnerability scan starts report-only so a finding baseline can be built
before it gates merges; scanner and transport errors still fail the job, and
inventory writeback stays off. The malware scan keeps the upstream default of
strict, where SUSPICIOUS blocks as well as MALICIOUS.

Both scans report to the same nSpect registration, because an nSpect ID
identifies the repository rather than one scan. `nspect-id` reads the
`NSPECT_ID` Actions variable and falls back to this repository's ID literally,
so the suite works whether or not the variable has been provisioned; drop the
fallback once it has.

No permission change: the suite's union is contents/actions read plus id-token
and security-events write, all of which this caller already grants.

Both scans cross a Charon tunnel that authorizes per repository and per ref.
charon!242 brings this repository's tenant to parity with the one the upstream
workflows are tested against and grants `main` plus the `pull-request/*`
mirrors; the prerequisites are summarised in ci/README.md.

Author: gmanal

.github/workflows/security-suite.yml

@@ -2,10 +2,12 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 #
-# CI security scanning via the NVIDIA/security-workflows suite: Pulse secret scan + CodeQL SAST.
+# CI security scanning via the NVIDIA/security-workflows suite: Pulse secret scan,
+# Pulse OSS vulnerability scan (SCA), Pulse malware scan, and CodeQL SAST.
 # Pulse runs on Linux nv-gha-runners (Docker image + OIDC/Vault) — Linux-only by design.
 # The local secret-scan-trufflehog pre-commit hook is cross-platform (Linux/macOS/Windows).
 # Pinned to a reviewed commit SHA.
+# The vulnerability and malware scans cross a Charon tunnel; see ci/README.md.
 
 name: Security Suite (Pulse + CodeQL)
 
@@ -36,9 +38,11 @@ jobs:
     if: >-
       github.repository == 'NVIDIA/cuda-python' ||
       vars.CI_CUSTOMIZATIONS_SECURITY_SUITE_ENABLED == 'true'
-    uses: NVIDIA/security-workflows/.github/workflows/security-suite.yml@c736f0454dc99764a66af6b906adfcdfbf621985  # v0.4.0
+    uses: NVIDIA/security-workflows/.github/workflows/security-suite.yml@8d3d9236178d739920efcc2e0ecdd2a4a658f451  # test/vuln-malware-onboarding
     with:
       enable-secret-scan: true
+      enable-vuln-scan: true
+      enable-malware-scan: true
       enable-sast-scan: true
       secret-runs-on: linux-amd64-cpu4
       # Set failure_policy explicitly so enforcement can't drift with upstream defaults.
@@ -48,3 +52,12 @@ jobs:
       secret-failure-policy: unverified
       # Same analysis the retired codeql.yml performed: python, build-mode none, security-extended.
       sast-languages: '["python"]'
+      # Literal fallback until the NSPECT_ID variable is provisioned on this repository.
+      nspect-id: ${{ vars.NSPECT_ID || 'NSPECT-ZY2K-Y1V8' }}
+      vuln-runs-on: linux-amd64-cpu4
+      # report-only (default) — findings warn; fail-on-vulnerability — any finding fails. Errors always fail.
+      vuln-failure-policy: report-only
+      vuln-upload-report: true
+      malware-runs-on: linux-amd64-cpu4
+      # strict (default) — SUSPICIOUS fails too; malicious-only — it only warns. MALICIOUS always fails.
+      malware-failure-policy: strict

ci/README.md

@@ -232,3 +232,18 @@ The canonical `NVIDIA/cuda-python` repository does not need this variable
 because its standard workflow behavior is enabled directly. Before enabling a
 customization elsewhere, document the repository-specific prerequisites and
 verification procedure in that repository's own documentation.
+
+### Security Suite scan prerequisites
+
+The secret scan and CodeQL SAST need only the Vault variables already
+provisioned for this repository. The Pulse OSS vulnerability scan and the Pulse
+malware scan additionally reach NVIDIA-internal services through a Charon
+tunnel, which authorizes **per repository and per ref**, and both read the
+repository's `NSPECT_ID` Actions variable.
+
+The Charon tenant must list every ref the suite scans — `main`, `ctk-next`, and
+the `pull-request/*` mirrors — and grant the routes each scan calls, including
+`POST /v1/sourceCode/scan`, which is not granted to tenants by default. An
+unlisted ref or route surfaces as an opaque `403` from inside the scanner, so
+confirm the tenant before debugging anything else. The secret scan and SAST are
+unaffected; neither crosses the tunnel.