feat(templates): add scan options

[ocervell]

I want to be able to add scan options that would control workflow options, for instance, for the domain scan:

options:
   passive:
      is_flag: True
      default: False
      help: "Passive scan"
      set:
         domain_recon_passive: True
         host_recon_passive: True
         subdomain_recon_passive: True
         url_crawl_passive: True
         url_vuln_passive: True

@claude please investigate how to make this work cleanly and propose a PR.

[claude]

Claude finished @ocervell's task in 16m 2s —— View job • claude/issue-1118-20260605-1137 • Create PR ➔

---

Implementation Complete

Summary of changes (9 files, +203/-2 lines):

Core logic

• secator/runners/scan.py — Added _expand_scan_opts() method that reads scan config options with set keys and expands them into run_opts when the option is truthy. Also fixed build_celery_workflow() to extract default values from option definitions (instead of passing the full definition dicts to child workflows, which would cause false-truthy values).
• secator/template.py — get_config_options() now renames workflow options when they share a name with a scan-level option (k in config_opts), preventing the scan-level option from being overwritten in the CLI option map.
• secator/cli_helper.py — decorate_command_options() now strips the set key from option configs before passing to click (it's internal metadata, not a click parameter).

Scan YAML configs

All 5 scan configs now have a --passive scan-level option with a set mapping:

options:
  passive:
    is_flag: True
    default: False
    help: "Passive scan (no active requests to targets)"
    short: ps
    set:
      domain_recon_passive: True
      subdomain_recon_passive: True
      host_recon_passive: True
      url_crawl_passive: True
      url_vuln_passive: True

When a user runs secator s domain --passive, the passive=True is expanded into the workflow-specific prefixed options (domain_recon_passive, etc.). Each workflow's runner strips its own prefix (e.g., domain_recon_passive → passive) so all task if: not opts.passive conditions resolve correctly.

Tests (tests/unit/test_template.py)

5 new test cases:

• test_get_config_options_scan_with_scan_level_opts — scan-level option is preserved, workflow options renamed
• test_expand_scan_opts — set mapping expands into run_opts when option is truthy
• test_expand_scan_opts_default_false — no expansion when option defaults to False
• test_expand_scan_opts_does_not_override_explicit_opts — explicit workflow opts are not overwritten
• test_dry_run_with_scan_level_option_sets_workflow_conditions — scan option enables task conditions in child workflows

Todos:

• Analyze current scan/workflow architecture
• Understand how options flow from scans to workflows
• Design the scan options feature
• Implement _expand_scan_opts() in scan.py
• Fix template.py to prevent scan-level option override by workflow options
• Update cli_helper.py to strip set key from click options
• Update scan YAML configs with passive option
• Add tests
• Commit and push changes

|