Motivation

This is a small follow-up to PR #179. After defaulting the engine to Rego v1, the dd_iac_compat shim still merged results from the pre-rename data.Cx.CxPolicy path even though every shipped rule now exposes data.datadog.DatadogPolicy. The CxPolicy leg is unused dead code; removing it drops an extra OPA module from every evaluation and simplifies the top-level query.

Changes

Engine

Stop injecting dd_iac_compat.rego alongside rule modules.

Query defaults

Set RegoQuery to result = data.datadog.DatadogPolicy and delete the RegoCompatShim constant.

Author Checklist

• I have reviewed my own PR.
• I have added or updated relevant unit tests where necessary. If no tests are added, I've explained why.
• All new and existing tests pass.
• I have tested my changes on staging (if applicable).
• I have updated any relevant documentation (if applicable).

QA Instruction

1. go test ./pkg/engine/... ./pkg/utils/... ./pkg/scan/...
2. Run a scan against a fixture or project that uses Datadog-sourced rules and confirm findings still appear as before.

Blast Radius

Datadog IaC Scanner OPA evaluation only: rule modules must continue to define package datadog with a DatadogPolicy rule set, which is already the contract after the rename migration.

Additional Notes

None.

I submit this contribution under the Apache-2.0 license.