Add secrets config: ignore/only paths, gitignore, generated files, max file size

[MikaYuoadas]

What

Splits CliConfiguration into RunConfiguration, SastConfiguration, and SecretsConfiguration, breaks main() into per-product functions, and gives secrets its own independent configuration-file parser. Adds four secrets.global-config options, mirroring the existing sast schema:

schema-version: v1.5
secrets:
  global-config:
    ignore-paths:
      - "vendor/**"
    only-paths:
      - "src/**"
    use-gitignore: false
    ignore-generated-files: false
    max-file-size-kb: 500

Why

Previously SAST's file-selection settings (paths, gitignore, generated-files, size limits) could silently govern secrets scanning too, since both products shared one configuration struct and one file-selection code path. There was also no way to configure secrets scanning independently at all.

Behavior

• SAST and secrets each build their own file selection and read their own configuration-file section; an invalid section for a disabled product is never even parsed, so it can't fail the other product's scan.
• Git-history secret scanning now uses secrets' own (opt-in) max-file-size-kb instead of SAST's, so it's unbounded until a limit is configured.
• This groundwork makes it straightforward to eventually fork the binary into separate SAST-only and secrets-only codebases.

[datadog-datadog-prod-us1-2]

🔄 Datadog auto-retried 1 job - 1 passed on retry

🎯 Code Coverage (details)
• Patch Coverage: 40.03%
• Overall Coverage: 85.03% (-0.90%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 186b77a | Docs | Datadog PR Page | Give us feedback!}

[Copilot]

Pull request overview

This PR refactors CLI configuration so SAST and secrets have independent config parsing and independent file-selection controls, preventing one product’s settings from silently affecting the other. It also factors shared primitives (schema version + path include/exclude) into common and updates binaries/server call sites accordingly.

Changes:

• Split former shared CLI config into RunConfiguration, SastConfiguration, and SecretsConfiguration, and update consumers to use per-product configs.
• Add an independent secrets YAML parser for the secrets section and wire it into local/remote config loading.
• Introduce product-scoped file selection (ignore/only paths, gitignore, generated files, max size) so SAST and secrets build separate file lists.

Reviewed changes

Copilot reviewed 28 out of 29 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
crates/static-analysis-server/src/request.rs	Use SAST-only config when building rule config provider for server requests.
crates/static-analysis-kernel/src/rule_overrides.rs	Make overrides builder accept SAST section directly (optional).
crates/static-analysis-kernel/src/rule_config.rs	Build rule config provider from optional SAST config section only.
crates/static-analysis-kernel/src/config/file_v1.rs	Re-home YAML path config/schema imports; remove duplicated YamlPathConfig.
crates/static-analysis-kernel/src/config/common.rs	Re-export shared config/path primitives from common; simplify parsing logic.
crates/static-analysis-kernel/src/arguments.rs	Read rule arguments from optional SAST config section.
crates/static-analysis-kernel/src/analysis/analyze.rs	Update tests to build rule config provider from local_config.sast().
crates/secrets/src/lib.rs	Export new config module.
crates/secrets/src/config/file_v1.rs	Add secrets-only v1.x parser for secrets.global-config options.
crates/secrets/src/config.rs	Add secrets config module root.
crates/secrets/Cargo.toml	Add serde_yaml and thiserror for secrets config parsing.
crates/common/src/model/path_config.rs	Add shared PathConfig / PathPattern / YamlPathConfig for all products.
crates/common/src/model/config_method.rs	Add shared ConfigMethod + YamlSchemaVersion (and tests).
crates/common/src/model.rs	Export new config_method and path_config modules.
crates/common/Cargo.toml	Add globset + dev serde_yaml for new shared model modules.
crates/cli/src/utils.rs	Split configuration printing into run/SAST/secrets sections.
crates/cli/src/sarif/sarif_utils.rs	Update SARIF generation to accept run/SAST/secrets configs separately.
crates/cli/src/rule_utils.rs	Make rule conversion consume SAST config (rules + perf flag).
crates/cli/src/model/secrets_configuration.rs	Add secrets-only CLI configuration struct (rules + path selection + max size).
crates/cli/src/model/sast_configuration.rs	Rename/re-scope former CLI config into SAST-only config and update diff-aware hashing.
crates/cli/src/model/run_configuration.rs	Add run-level config shared across products (paths/output/threads/flags).
crates/cli/src/model.rs	Update model exports for new configuration split.
crates/cli/src/file_utils.rs	Introduce ProductFileSelection + select_files to build per-product file lists.
crates/cli/src/config_file.rs	Add ConfigFile wrapper and parse SAST/secrets sections independently based on enabled products.
crates/bins/src/lib.rs	Split static vs secrets analysis function signatures to take run + per-product configs.
crates/bins/src/git_history.rs	Use secrets-specific max file size for history scanning; adapt to new config split.
crates/bins/src/bin/datadog-static-analyzer.rs	Major CLI refactor: parse args, load config, resolve per-product configs, run products independently, build report.
crates/bins/src/bin/datadog-static-analyzer-git-hook.rs	Update git-hook binary to new config split and per-product file selection.
Cargo.lock	Lockfile updates for new dependencies (globset, serde_yaml, thiserror).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.