feat: staged diff scanning, false-positive fixes, and a 4-9x faster scanner

.github/workflows/ci.yml

@@ -3,7 +3,7 @@ name: CI-push
 on:
   push:
     branches:
-      - main
+      - master
   merge_group:
     types:
       - checks_requested

.github/workflows/update-baseline.yml

@@ -0,0 +1,51 @@
+name: Update baseline
+
+# Manually triggered on purpose: automatically re-baselining on every push
+# would silently accept newly introduced secrets. This regenerates
+# .keywatch-baseline.json and opens a pull request so each newly baselined
+# finding gets human review. (Neither gitleaks nor ggshield auto-update
+# their baselines for the same reason.)
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  update-baseline:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: stable
+
+      - name: Build key-watch
+        run: cargo build --release --locked
+
+      - name: Regenerate baseline
+        run: ./target/release/key-watch scan . --update-baseline
+
+      - name: Open pull request if the baseline changed
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          if [ -z "$(git status --porcelain -- .keywatch-baseline.json)" ]; then
+            echo "Baseline unchanged; nothing to do."
+            exit 0
+          fi
+          branch="chore/update-baseline-${{ github.run_id }}"
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git checkout -b "$branch"
+          git add .keywatch-baseline.json
+          git commit -m "chore: update keywatch baseline"
+          git push origin "$branch"
+          gh pr create \
+            --title "chore: update keywatch baseline" \
+            --body "Regenerated by the update-baseline workflow. Review every newly baselined finding before merging: each entry is a finding KeyWatch will stop reporting." \
+            --base "${{ github.ref_name }}"