ci: avoid fetching full history for the Pulse secret scan - #3312

— codex GPT-6 on behalf of Ralf —

Description

Related to #2197. Depends on NVIDIA/security-workflows#28.

Update the Security Suite pin to the proposed shallow Pulse checkout. The current full-history checkout fetches every branch and tag, including gh-pages; the observed fetch took 315.6 seconds in https://github.com/NVIDIA/cuda-python/actions/runs/41166557387/job/124435280090.

Pulse still runs its existing filesystem scan with the same image, result filters, failure policy, and SARIF publication. The new pin also contains additive suite features from upstream main; vulnerability and malware scans remain disabled. CodeQL's existing configuration and this workflow's permissions and triggers are unchanged.

Keep this PR as a draft while the shared-workflow fix is reviewed. Validation will manually dispatch only .github/workflows/security-suite.yml on this branch, comparing checkout timing and checking Pulse, SARIF upload, enforcement, and CodeQL results.

Validation:

• Shared-workflow YAML parsing and semantic comparison pass; only the Pulse checkout name/depth change.
• Shared-workflow pre-commit checks, including actionlint, pass.
• CUDA Python actionlint and YAML semantic comparison pass. The full repository pre-commit run passes, including documentation link checks and both mypy hooks.
• Security Suite manual run: https://github.com/NVIDIA/cuda-python/actions/runs/41168145731. GitHub rejected the shared workflow with "workflow was not found" before creating any jobs.
• Checkout speed and Pulse runtime validation remain blocked: the shared fix must first be published on an upstream branch or merged by a NVIDIA/security-workflows maintainer. A squash/rebase merge will require updating this pin to the resulting commit before rerunning. No other workflow was manually dispatched.

Checklist

• I have read the Contributing Guidelines.
• New or existing tests cover these changes.
• The documentation is up to date with these changes (shared workflow catalogue and changelog).