The worst security model is the one that runs quarterly and produces a PDF nobody reads. The best one runs on every commit and fails the build. NVIDIA's security-workflows repo is the latter, packaged as reusable GitHub Actions.
What it is
NVIDIA security-workflows is a collection of centrally maintained, reusable GitHub Actions workflows for the security-compliance scans rolled out by NVIDIA's security team. Instead of each repo reinventing its own scan, every repo can pull the same battle-tested workflow.
Why it matters
- Consistency. Every repo runs the same scans with the same thresholds. No drift.
- Maintenance. The security team updates the workflow once, and every repo gets the fix.
- Shift-left. Scans run on every PR, so vulnerabilities are caught before merge, not after deploy.
Mental model
security-workflows is the "single source of truth" for your security scans. Write the scan once, run it everywhere.
The takeaway
Security that runs in CI is security that actually happens. Package your scans as reusable workflows and make compliance the default.
Sources
- security-workflows repo: the reusable GitHub Actions for security scans.
- GitHub Actions docs: how reusable workflows work.
- Model-Optimizer repo: the optimization library with its own security posture.