Scan git history for removed secrets

[MikaYuoadas]

What

Adds a --scan-git-history-only flag to the secrets scanner. When enabled, the scan reports secrets that existed in past commits but are no longer present at the branch HEAD.

The scan runs in two passes:

• Pass 1 scans every unique blob in the object database once (content-addressed, so each blob is scanned a single time regardless of how many paths or commits reference it).
• Pass 2 attributes only the blobs that actually contained a secret back to their path, introducing commit, and removal commit by streaming a single git log --raw over all branches. A blob with no reachable addition on any branch is dropped.

Historic findings are published in a separate SARIF run under the datadog-static-analyzer-secrets-history tool driver, so they stay distinct from the regular HEAD scan results.

Why

Secrets that were committed and later deleted still live in the repository history and can be recovered by anyone with a clone. A HEAD-only scan never surfaces them. This flag lets a scan cover that gap without slowing down or altering the normal HEAD scan, which continues to run as before.

Notes

• The two-pass design keeps the hot path off any per-commit tree walk: Pass 1 is linear in the number of unique blobs, and the expensive reverse-mapping in Pass 2 only runs for the handful of blobs that contain a secret.
• Blob scanning in Pass 1 runs in parallel.

[Copilot]

Pull request overview

Adds an opt-in “git history only” secrets scan mode that surfaces secrets removed from the working tree but still present in reachable Git history, and emits these findings under a distinct SARIF tool name/run.

Changes:

• Extend SecretResult with history metadata (is_git_history_only, introducing SHA, removal SHA) and helper cloning for per-path fan-out.
• Add SARIF support for distinct tool driver names and splitting into multiple runs (static vs. secrets-history) when in history mode.
• Implement two-pass history scanning in the binary crate (scan all unique blobs, then attribute secret-bearing blobs to paths/commits) and add --scan-git-history-only CLI flag plus tests.

Reviewed changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
crates/secrets/src/scanner.rs	Initialize new history-related fields on normal secret findings.
crates/secrets/src/model/secret_result.rs	Add history metadata fields and a path-cloning helper for blob→path fan-out.
crates/cli/src/sarif/sarif_utils.rs	Add per-finding history info, make tool name configurable, and split SARIF into separate runs in history mode (with tests).
crates/cli/src/constants.rs	Introduce tool-name constants and SARIF property keys for history metadata.
crates/bins/src/lib.rs	Implement two-pass Git history secrets scan (blob scan + attribution) and add targeted tests.
crates/bins/src/bin/datadog-static-analyzer.rs	Add --scan-git-history-only flag and wire it into secrets execution + SARIF metadata.
crates/bins/src/bin/datadog-static-analyzer-git-hook.rs	Populate new SARIF metadata tool_name field.
crates/bins/Cargo.toml	Add tempfile dev-dependency for Git history tests.
Cargo.lock	Lockfile update for tempfile.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[datadog-datadog-prod-us1]

🎯 Code Coverage (details)
• Patch Coverage: 85.12%
• Overall Coverage: 85.93% (+0.08%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 593bb45 | Docs | Datadog PR Page | Give us feedback!}

[robertohuertasm-datadog]

LGTM! 🚀

[robertohuertasm-datadog]

LGTM! 🚀