Add AnalysisError type and wrap all analyzer error paths

[johnelliott]

What this does

Adds a shared error type so analyzer failures carry structured metadata (analyzer type, operation, service). Currently only GCP errors have this; the other 44 analyzers return bare errors.New that get stored as "unknown" in the database.

How to review

Read one file, skip the other 44. There are only 2 things to look at:

1. The new error type (entire abstraction)

pkg/analyzer/analyzers/errors.go -- new file:

// Constants for structured error metadata
const (
    OperationValidateCredentials = "validate_credentials"
    OperationAnalyzePermissions  = "analyze_permissions"
)
const (
    ServiceAPI      = "API"
    ServiceConfig   = "config"
    ServiceDatabase = "Database"
    ServiceOAuth    = "OAuth"
    ServiceCrypto   = "crypto"
)

type AnalysisErrorInfo interface {
    error
    AnalyzerType() string
    Operation() string
    Service() string
    Resource() string
}

type AnalysisError struct {
    analyzerType, operation, service, resource string
    err error
}

func NewAnalysisError(analyzerType, operation, service, resource string, err error) *AnalysisError

2. The pattern every analyzer follows

Every analyzer diff looks like this (Airbrake shown):

// Before:
return nil, err

// After:
return nil, analyzers.NewAnalysisError(
    a.Type().String(),                      // dynamic from analyzer's own type
    analyzers.OperationAnalyzePermissions,  // constant
    analyzers.ServiceAPI,                   // constant
    "",
    err,
)

The original error is wrapped, not replaced (Unwrap() preserves the chain). Analyzer type is derived dynamically via a.Type().String(). Two operation constants are used: OperationValidateCredentials for bad input, OperationAnalyzePermissions for API/DB failures.

All 44 analyzer files are this same 1-3 line change. You can spot-check a few and skip the rest.

Part of a cross-repo change

Order	Repo	PR	What
1	trufflehog	this PR	Define error type + constants, wrap 44 analyzers
2	integrations	#118	Wrap 10 integrations analyzers
3	thog	#5724	Scanner consumes the metadata via errors.As()

Test plan

• go test ./pkg/analyzer/analyzers/... (includes errors_test.go)
• go build ./pkg/analyzer/analyzers/...

---

Note

Medium Risk
Touches many analyzers’ Analyze error paths; while changes are mechanical, they alter the error types and messages that downstream consumers may depend on.

Overview
Adds a new analyzers.AnalysisError (and AnalysisErrorInfo interface) plus shared operation/service constants so analyzer failures can be reported with structured metadata while preserving the original error via Unwrap().

Updates a broad set of analyzers to wrap all Analyze-time failures (missing/invalid credential fields and API/DB/crypto permission checks) using analyzers.NewAnalysisError(...) instead of returning raw errors, and includes unit tests for the new error type.

^{Reviewed by Cursor Bugbot for commit e21487f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[CLAassistant]

All committers have signed the CLA.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9fe25fe. Configure here.}