[rwgk]

— codex GPT-6 on behalf of Ralf —

Pulse's filesystem scan currently starts with fetch-depth: 0, downloading every branch and tag's history. In NVIDIA/cuda-python, this fetched the large gh-pages history and took 315.6 seconds before the scan could start: https://github.com/NVIDIA/cuda-python/actions/runs/41166557387/job/124435280090. Related: NVIDIA/cuda-python#2197.

Use a depth-one checkout and rename the misleading "full history" step. The scanner still runs the same filesystem /repo command with the same result filters, failure policy, credential handling, and SARIF publication. Document the existing filesystem scope in the workflow catalogue and record the fix in the changelog.

Validation:

• All 11 tracked YAML files parse.
• Comparing parsed workflows confirms that only the checkout step's name and depth change.
• All pre-commit checks pass, including YAML parsing, yamllint, actionlint, and codespell.
• Companion CUDA Python Draft PR: ci: avoid fetching full history for the Pulse secret scan cuda-python#3312. It pins this commit and changes no scanner settings.
• Only the CUDA Python Security Suite was manually dispatched: https://github.com/NVIDIA/cuda-python/actions/runs/41168145731. GitHub rejected the reusable-workflow reference before creating any jobs: "workflow was not found." Although the Contents API resolves this fork PR commit under the upstream repository, Actions does not accept it there yet.
• Live checkout timing and Pulse validation are blocked until a maintainer publishes the fix on a branch in NVIDIA/security-workflows or merges it. If merge changes the commit SHA, update the consumer pin before rerunning. No upstream CI or other workflow was manually dispatched.

This remains a Draft PR so CI and review can be coordinated with the maintainers. No workflow interface, scanner mode, or enforcement-policy change is proposed.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[rwgk]

I asked codex about similar existing issues:

I found no recorded rejection of making Pulse’s checkout shallow in the requested sources.

In security-workflows, I checked all 23 PRs predating our draft, including discussions and reviews. There are no ordinary issues. The initial Pulse PR #5 already combined fetch-depth: 0 and “full history for secret scan” with a filesystem scan, but I found no explanation of why history was necessary.

Then I searched CUDA Python issues only. Two relevant decisions surfaced:

• #2091, opened by Leo, explicitly proposed shallow checkouts for file-only jobs and blob filtering where ancestry was needed. It was completed in June, before Pulse was introduced.
• #2197 did contain a decision to defer addressing gh-pages size. The concerns involved rewriting its history: preserving documentation, coordinating concurrent publishers, and force-push restrictions. The deferral comment attributes that recommendation to Leo.

That second decision concerns changing the published gh-pages history. Our proposed fix changes what Pulse downloads.

So the handoff still looks reasonable. The unresolved question for the shared-workflow maintainers is whether the original full-history setting reflects an intended scan requirement that wasn’t documented in these discussions.

[rwgk]

The one workflow failure looks like a flake, but I don't see a Rerun button.

---

codex:

The failed job runs the Pulse OSS vulnerability scanner. At 00:53:46 UTC, its Black Duck client failed during authentication while retrieving the scan report:

RuntimeError: ('Unhandled HTTP response', <Response [503]>)

The scanner returned exit code 1. The workflow captured that status, then correctly failed in Enforce scan result. report-only allows vulnerability findings to remain warnings; scanner and service errors still fail. Enforcement source.