feat: user config file, SARIF output, detector overrides, pre-commit hooks

[pixincreate]

Summary

Implements the remaining non-CI/CD feature gaps from #71: user-configurable .keywatch.toml, SARIF output format, per-detector enable/disable and severity overrides, and pre-commit framework support.

Changes

User Config (.keywatch.toml)

• New src/config.rs module for loading and parsing user config
• Config file discovered at --config <path> or auto-detected (.keywatch.toml → keywatch.toml → .kw.toml)
• Custom rules: add detectors beyond the built-in detectors.toml
• Detector overrides: disable any built-in detector, or override its severity
• Exclude patterns: additional exclude patterns merged with --exclude CLI flag

Example config:

[[rules]]
name = "MyCustomDetector"pattern = "\\bSECRET_[A-Z]+\\b"finding_type = "Custom Secret"severity = "HIGH"
[overrides]
AWSKeyDetector = { enabled = false }
GitHubTokenDetector = { severity = "CRITICAL" }
exclude = ["*.test.js"]

SARIF Output

• New --format flag: key-watch scan <paths> --format sarif
• Generates SARIF 2.1.0 compliant JSON output
• Severity mapping: CRITICAL/HIGH → error, MEDIUM → warning, LOW → note
• Includes tool metadata, file locations with line numbers, and severity in SARIF properties

CRITICAL Severity

• New Severity::Critical variant (serialized as CRITICAL)
• from_string() now recognizes "CRITICAL"
• Merged into get_severity_counts (Critical counted with High)
• Exit code calculations updated to treat Critical as High

Per-Detector Enable/Disable

• Config overrides can disable detectors by name (enabled = false)
• Disabled detectors are filtered out before scanning
• Severity overrides change severity at scan time

Pre-Commit Framework

• .pre-commit-hooks.yaml for use with pre-commit

CRITICAL Severity Variant

This PR reinstates the CRITICAL severity level (also in PR #69, not yet in master) so users can flag high-value secrets (AWS root, GitHub PATs) above standard HIGH.

Future Work (not in this PR)

• Expression-based allowlists (CEL)
• Secrets validation (async HTTP credential check)
• Homebrew formula

[Copilot]

Pull request overview

This PR closes the remaining feature gaps from #71 by adding user-configurable scanning behavior via a TOML config file, introducing SARIF output for Code Scanning integration, and expanding integration support via pre-commit hooks, while also reinstating CRITICAL severity handling across the reporting/exit-code pipeline.

Changes:

• Added .keywatch.toml support (custom rules, per-detector enable/disable + severity overrides, and config-driven exclude patterns).
• Added --format with SARIF 2.1.0 output generation alongside JSON.
• Refactored hook install/uninstall into src/hooks.rs and added pre-commit framework hook definitions.

Reviewed changes

Copilot reviewed 10 out of 11 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
tests/scanner_tests.rs	Updates tests for new ScanArgs fields and run_scan signature.
src/scanner.rs	Accepts optional config, applies detector overrides, and merges config exclude patterns.
src/report.rs	Adds CRITICAL severity and implements SARIF report generation.
src/lib.rs	Loads config, selects JSON vs SARIF output, and routes hook commands through hooks module.
src/hooks.rs	Implements install_hook/uninstall_hook and hook-safety logic in the hooks module.
src/config.rs	Introduces config parsing/loading and applying custom rules/overrides/excludes to detectors.
src/cli.rs	Adds --config and --format CLI options plus OutputFormat enum.
README.md	Adds an architecture section and references the new diagram.
docs/architecture.svg	Adds an SVG architecture diagram for documentation.
CHANGELOG.md	Documents config, SARIF, CLI flag changes, and updated severity counts/run_scan signature.
.pre-commit-hooks.yaml	Adds pre-commit hook metadata for KeyWatch scanning.

Suppressed comments (2)

src/report.rs:120

• SARIF result objects require ruleId, but this struct currently serializes rule_id (snake_case), which breaks SARIF 2.1.0 schema expectations.

 #[derive(Serialize)]
struct SarifResult {
rule_id: String,
level: &'static str,
message: SarifMessage,

src/report.rs:134

• SARIF location fields are currently serialized as physical_location, artifact_location, and start_line (snake_case). SARIF 2.1.0 expects physicalLocation, artifactLocation, and startLine, so the report will not be schema-compliant.

 #[derive(Serialize)]
struct SarifLocation {
physical_location: SarifPhysicalLocation,
}