AST-120196-Enable/disable commit history scanning

[cx-rui-oliveira]

Description

This PR adds support for enabling/disabling Git commit history scanning in Secret Detection scans through a new CLI flag --git-commit-history. This enhancement allows users to explicitly enable scanning of the full Git commit history to detect secrets that may have been committed in the past, even if they've been removed from the current working tree.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update

Related Issues

Ticket: AST-120196

Checklist

• I have performed a self-review of my code
• I have added tests that prove my fix is effective or that my feature works
• I have added necessary documentation (if appropriate)
• Any dependent changes have been merged and published in downstream modules
• I have updated the CLI help for new/changed functionality in this PR (if applicable)
• All active GitHub checks for tests, formatting, and security are passing
• The correct base branch is being used

Screenshots (if applicable)

• N/A.

Additional Notes

• N/A.

[github-actions]

Checkmarx One – Scan Summary & Details – 764923a8-a2f8-4086-8663-bed9c98af2d2

Great job! No new security vulnerabilities introduced in this pull request

[cx-umesh-waghode]

@cx-rui-oliveira Could you comment on below?

1. What is the behavior when SCS --scan-type is provided without --scs-engines?
2. Same as above but when --scs-engines is provided with scorecard only.
3. what is the behavior when SCS new license is disabled

[cx-rui-oliveira]

@cx-rui-oliveira Could you comment on below?

1. What is the behavior when SCS --scan-type is provided without --scs-engines?
2. Same as above but when --scs-engines is provided with scorecard only.
3. what is the behavior when SCS new license is disabled

1. We consider that both scs engines are enabled (2ms and scorecard), so if the user also specifies --git-commit-history true it will be enough to execute commit history scanning.
2. Only scorecard is enabled, so git-commit-history is ignored (the following warning is triggered: Secret Detection scan warning: Commit History applies only to Secret Detection. The flag will be ignored.
3. If the FF SSCS_NEW_LICENSING_ENABLED is enabled and the new license is disabled, git-commit-history will be ignored, since 2ms is not enabled. If the FF SSCS_NEW_LICENSING_ENABLED is disabled and the new license is disabled, the old license is considered (and git commit history is enabled or disabled accordingly with it).

[cx-anurag-dalke]

ok