Add a static check for detectors that don't set SecretParts

[mcastorina]

Summary

Adds a small static-analysis tool under hack/checksecretparts/ that scans pkg/detectors/ and warns about detector packages that construct detectors.Result values without ever populating the new SecretParts field.

It's wired into the Lint workflow as warning-only (continue-on-error: true): findings show up in CI but don't block merges. The intent is to land the check before every detector is migrated to aid in migrating the packages.

Stacked on #4911 (the rename that introduces SecretParts); that needs to land first.

Why

SecretParts replaces the old AnalysisInfo field and is expected to be populated by every detector going forward. Today only ~11 detectors set it. Rather than wait for a big-bang migration, this PR adds the enforcement mechanism first so each incremental migration PR gets immediate feedback, and so the flip from warning to hard-fail becomes a one-line workflow change once the migration is complete.

What it does

• For each directory under pkg/detectors/, finds composite literals of the form detectors.Result{...} or &detectors.Result{...} in non-test .go files.
• If the package never mentions SecretParts in any non-test source (neither in the literal nor in a later x.SecretParts = ... assignment), emits one warning per construction site.
• Ignores _test.go files on both sides — some tests zero the field for cmp comparisons (e.g. pkg/detectors/gitlab/v1/gitlab_integration_test.go) and those references would otherwise mask real findings.

No new module dependencies — just go/ast and go/parser.

How to run

# Warning mode (default), exit 0 even with findings:
go run ./hack/checksecretparts

# Fail mode, exit 1 on findings — for use after the full migration:
go run ./hack/checksecretparts -fail

# Scoped to specific packages:
go run ./hack/checksecretparts ./pkg/detectors/aws ./pkg/detectors/github

Full instructions for flipping warning → hard-fail are in hack/checksecretparts/README.md.

Verification

• go test ./hack/checksecretparts/ — 8 cases covering missing-field, literal-populated, later-assigned, pointer literal, multiple sites, test-file-only references (must not suppress), and no-op packages.
• Against the current tree: 825 findings. Spot-checked that every detector already known to populate SecretParts (postmark, databricks, figma, ngrok, monday, airbrake, digitalocean, datadog, tableau) is correctly exempted.
• go vet ./... and go build ./... are clean.

Out of scope

• Populating SecretParts on any real detector — that's a separate migration.
• Flipping the check to hard-fail — to be done in a one-liner follow-up once migration completes.
• Deeper dataflow (per-code-path verification). The package-level heuristic is deliberately coarse; it's enough to surface unmigrated detectors and doesn't risk false positives on the migration PRs themselves.

---

Note

Low Risk
Low risk: adds a new warning-only CI/static-analysis tool and tests without changing runtime detector behavior; main impact is additional lint workflow time/output.

Overview
Adds hack/checksecretparts, a small Go AST-based scanner that reports (and optionally fails on) detector packages that build detectors.Result{} / &detectors.Result{} without any non-test reference to SecretParts, plus unit tests and documentation.

Wires the scanner into .github/workflows/lint.yml as a warning-only checksecretparts job (continue-on-error: true) to surface unmigrated detectors in CI without blocking merges.

^{Reviewed by Cursor Bugbot for commit fc9bdaa. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9843976. Configure here.}

[rosecodym]

I only barely skimmed the new check itself, but I like the approach and the test suite.