ci: enable secret-scan-trufflehog pre-commit hook

[mc-nv]

What does the PR do?

Enables the NVIDIA secret-scan-trufflehog pre-commit hook, pinned to v0.3.0,
as the first entry under repos: so scanning runs before any formatter rewrites
the working tree.

This adopts the centrally maintained hook published by NVIDIA/security-workflows
rather than a hand-rolled TruffleHog invocation, so the scanner version and its
per-platform checksums are bumped in one reviewed place instead of 27.

v0.3.0 is pinned deliberately. It installs the scanner inside pre-commit's own
Python environment — removing the shell installer, so Windows works without Git
Bash — and it adds --exclude-detectors=lob. That exclusion matters for this
repo in particular: a Lob API key is test_ followed by 35 characters, so the
detector matches ordinary pytest function names such as
test_gpu_conf_compute_attestation_report, and Lob's verifier reports them as
verified — the one result class this hook fails on. qa/ is full of exactly
those names.

Behaviour: scans only the files pre-commit supplies (staged files at commit time,
the push range at push time), reports verified secrets only, and fails closed on
a finding.

Deliberately out of scope: no ci: skip: block (that is for the hosted
pre-commit.ci sandbox, which no Triton repo uses — CI runs pre-commit from
.github/workflows/pre-commit.yml), and no default_install_hook_types change
(activation is a developer action, and that key would alter install behaviour for
every hook in the repo, not just this one).

Checklist

• PR title reflects the change and is of format <commit_type>: <Title>
• Changes are described in the pull request.
• Related issues are referenced.
• Populated github labels field
• Added test plan and verified test passes.
• Verified that the PR passes existing CI.
• Verified copyright is correct on all changed files.
• Added succinct git squash message before merging ref.
• All template sections are filled out.
• Optional: Additional screenshots for behavior/output changes with before/after.

Commit Type:

Check the conventional commit type
box here and add the label to the github PR.

• build
• ci
• docs
• feat
• fix
• perf
• refactor
• revert
• style
• test

Related PRs:

• ci: enable secret-scan-trufflehog pre-commit hook core#521
• ci: enable secret-scan-trufflehog pre-commit hook common#163
• ci: enable secret-scan-trufflehog pre-commit hook backend#128
• ci: enable secret-scan-trufflehog pre-commit hook client#916
• ci: enable secret-scan-trufflehog pre-commit hook python_backend#452
• ci: enable secret-scan-trufflehog pre-commit hook pytorch_backend#206
• ci: enable secret-scan-trufflehog pre-commit hook onnxruntime_backend#356
• ci: enable secret-scan-trufflehog pre-commit hook openvino_backend#120
• ci: enable secret-scan-trufflehog pre-commit hook tensorrt_backend#126
• ci: enable secret-scan-trufflehog pre-commit hook tensorrtllm_backend#862
• ci: enable secret-scan-trufflehog pre-commit hook vllm_backend#136
• ci: enable secret-scan-trufflehog pre-commit hook fil_backend#459
• ci: enable secret-scan-trufflehog pre-commit hook identity_backend#37
• ci: enable secret-scan-trufflehog pre-commit hook repeat_backend#20
• ci: enable secret-scan-trufflehog pre-commit hook square_backend#23
• ci: enable secret-scan-trufflehog pre-commit hook model_analyzer#1033
• ci: enable secret-scan-trufflehog pre-commit hook perf_analyzer#468
• ci: enable secret-scan-trufflehog pre-commit hook triton_cli#128
• ci: enable secret-scan-trufflehog pre-commit hook local_cache#17
• ci: enable secret-scan-trufflehog pre-commit hook redis_cache#25
• ci: enable secret-scan-trufflehog pre-commit hook checksum_repository_agent#15
• ci: enable secret-scan-trufflehog pre-commit hook developer_tools#62
• ci: enable secret-scan-trufflehog pre-commit hook third_party#81
• ci: enable secret-scan-trufflehog pre-commit hook tutorials#166

Also part of this rollout, on internal GitLab: dl/dgx/tritonserver!1853 and dl/dgx/tritonmodelanalyzer!181.

Where should the reviewer start?

.pre-commit-config.yaml — the change is a four-line addition at the top of
repos:. The reviewable decisions are the pinned rev and the placement.

Test plan:

• pre-commit validate-config — passes.

• pre-commit run secret-scan-trufflehog --all-files — passes across the whole
  tree, with zero pre-existing verified secrets, so CI does not break on merge.

• TruffleHog 3.95.9 confirmed installed into pre-commit's Python environment
  and executed, so the hook is functional rather than a silent no-op.

• Blast radius is bounded: .github/workflows/pre-commit.yml runs
  pre-commit run --files against PR-modified paths only, never --all-files,
  so this does not turn every PR into a full-tree scan.

• CI Pipeline ID:

Caveats:

Editing the config alone scans nothing. Each contributor must run once per clone:

pre-commit install --hook-type pre-commit
pre-commit install --hook-type pre-push

Without the second, the pre-push stage stays dormant. Whether to make that
automatic via default_install_hook_types is left to a follow-up, since it
changes install behaviour for all hooks.

Background

Triton repositories had no local secret-scanning control. A credential pasted
into a config, test fixture or CI fragment was only caught server-side, after it
had already reached the remote — at which point the only correct remedy is
rotation, not deletion.

Related Issues: (use one of the action keywords Closes / Fixes / Resolves / Relates to)

• Resolves: TRI-1701

[greptile-apps]

Greptile Summary

This PR adds NVIDIA’s pinned TruffleHog secret-scanning hook as the first pre-commit repository entry.

• Pins NVIDIA/security-workflows to v0.3.0.
• Enables the secret-scan-trufflehog hook before formatting hooks run.
• Keeps existing hook-installation defaults unchanged.

Confidence Score: 5/5

The PR appears safe to merge with no concrete changed-code defect identified.

The change is limited to a valid pinned pre-commit hook entry, and the supplied validation and execution results directly address configuration, installation, scanning scope, and existing-tree compatibility.

Important Files Changed

Filename	Overview
.pre-commit-config.yaml	Adds the centrally maintained, version-pinned secret-scanning hook without altering existing hook definitions.

_{Reviews (1): Last reviewed commit: "ci: enable secret-scan-trufflehog pre-co..." | Re-trigger Greptile}