[K9CODESEC-6268] Adjust how diff aware hash is computed

[jdelgo]

What problem are you trying to solve?

The diff aware hash stopped taking into account .gitignore and generated files in0.9.2 and surfaced again in 0.9.3. This resulted in:

• Changes to .gitignore could leave the config hash unchanged
• Changes to generated file handling could leave the config hash unchanged
• A baseline with different file selections could be selected, when we would need a new baseline run

What is your solution?

• Populate path_config for SAST and Secrets with ignored files after we resolve each's config
• Adjust select_files() to now use path_config instead of computing its own resolved files

Alternatives considered

• Building a shared path configuration. This overcomplicated the problem and instead we are now just reverting to old behavior
  Adding the missing values directly to the digest:
• This would fix the issue but would make it so different implementation for file selection and hashing could drift again. Sharing this path config keeps the two behaviors in line

What the reviewer should know

• This will invalidate config hashes that are using .gitignore and generated file exclusions. This is on purpose but will lead to new baseline runs occurring
• This doesn't change which files are selected and just makes the config hash more accurate

How did this behavior regress?

Before, we had cli_configuration which had function generate_diff_aware_digest() that took into account generated and gitignore'd files. This was populated in datadog-static-analyzer.rs. This means we were populating this path_config and then hashing it as we would want.

After, we do something similar in sast_configuration where we have generate_diff_aware_digest() but the issue is our path_config is not populated as we want. path_config is now populated in resolve_sast_config() but the issue is when it is called, we don't pass in any generated or gitignore'd files. That is resolved later in select_sast_files() where all the eligible SAST files are picked. This means we are correctly selecting the diff'd files, but we are just not accounting for that in the diff aware hash since we are not populating path_config

Testing

Ran the analyzer on the same repo with the same config but changed the .gitignore
Before changes:

• Baseline gitignore hash (sha: 24e4c7d79507ad0a7f15d04c5654ed34df947eac)
  338fe5f43fe965aa027c270679786d40b32361c5ad852697e756533720c1bc5a
• Adjusted gitignore hash (sha: 50ed41bd635d51acc19e9aa1d5ef427412ec9463)
  338fe5f43fe965aa027c270679786d40b32361c5ad852697e756533720c1bc5a
  Notice how they are the same hashes

After changes:

• Baseline gitignore hash (sha: 24e4c7d79507ad0a7f15d04c5654ed34df947eac)
  8a2087c0d36c1b4bada6c07865c7661be707c710077fa94e94293129175ad51b
• Adjusted gitignore hash (sha: 50ed41bd635d51acc19e9aa1d5ef427412ec9463)
  c73e82e1953c8810b68f3501444ee22a4c273ecb09764f7d019bba88ab48ac52
  Notice how the hashes are now different

[datadog-datadog-prod-us1]

🔄 Datadog auto-retried 1 job - 1 passed on retry

🎯 Code Coverage (details)
• Patch Coverage: 53.54%
• Overall Coverage: 85.61% (-0.10%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 5808ae9 | Docs | View more details | Give us feedback!}

[Copilot]

🟡 Changes recommended

The diff-aware hash can still miss generated-file flag changes and distinguishable .gitignore pattern changes.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Updates diff-aware hashing to reflect effective file-selection configuration.

Changes:

• Shares path configuration between selection and hashing.
• Includes .gitignore patterns and generated-file exclusions.
• Updates analyzer, git-hook, and test configuration handling.

File summaries

File	Summary
crates/cli/src/sarif/sarif_utils.rs	Updates test configuration construction.
crates/cli/src/model/sast_configuration.rs	Computes hashes from effective path settings; two moderate findings remain regarding generated-file flags and ambiguous pattern encoding.
crates/cli/src/file_utils.rs	Centralizes effective path configuration.
crates/bins/src/lib.rs	Handles the expanded SAST configuration.
crates/bins/src/bin/datadog-static-analyzer.rs	Passes shared path settings through the analyzer.
crates/bins/src/bin/datadog-static-analyzer-git-hook.rs	Propagates .gitignore patterns through git-hook scans.

Review details

• Files reviewed: 6/6 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[jasonforal]

So if I am reading the description correctly, before 0.9.2, we mutated ignore on PathConfig by pushing the globs from the .gitignore into it. But from 0.9.2, we no longer mutate ignore -- rather, we apply the filtering logic separately (via the new select_sast_files(...)).

Thus, one part of the system (diff aware digest) that assumed that .gitignore contents would be in the ignore field had its behavior altered.

---

So given that, while your PR works, it seems a bit over-complicated. Could we just have this PR restore the previous behavior? It's plausible that other parts of the system likewise assume .gitignore globs will show up in the ignore.

Would it work to instead (if the config requires) mutate the SastConfiguration's PathConfig to push all the gitignore globs to the ignore field (and likewise do the same for SecretsConfiguration)?