Repository navigation

[libcu++] Unwrap contiguous iterator adaptors back to their storage. #7746

	# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
	# SPDX-License-Identifier: Apache-2.0
	#
	# CI secret-scan enforcement via NVIDIA/security-workflows (Pulse).
	# Runs on Linux nv-gha-runners (Pulse Docker image + OIDC/Vault) — Linux-only by design.
	# The local secret-scan-trufflehog pre-commit hook is cross-platform (Linux/macOS/Windows via Git Bash).
	# Pinned to a reviewed commit SHA.

	name: Secret Scan (Pulse)

	on:
	push:
	branches:
	- main
	- "pull-request/[0-9]+"
	workflow_dispatch:

	concurrency:
	group: ${{ github.workflow }}-on-${{ github.event_name }}-from-${{ github.ref_name }}
	cancel-in-progress: true

	# Caller permissions must cover the reusable workflow (intersection applies).
	permissions:
	contents: read
	id-token: write # OIDC → Vault → nvcr.io image pull
	security-events: write # publish redacted SARIF to code scanning
	actions: read

	jobs:
	secret-scan:
	name: Secret Scan
	# Pulse needs nv-gha-runners + Vault/nvcr vars; skip on forks.
	if: github.repository == 'NVIDIA/cccl'
	uses: NVIDIA/security-workflows/.github/workflows/secret-scan-pulse.yml@69032f641c3c34e0c0b46f636b54ed2b101b7aa4
	with:
	runs-on: linux-amd64-cpu4
	# Set failure_policy explicitly so enforcement can't drift with upstream defaults.
	# unverified — fail on verified/live secrets (183); warn on unverified (185) [default]
	# strict — fail on any finding (verified or unverified)
	# all — warn only; never fail the job on findings
	failure_policy: unverified