Add the queries-path flag to the scanner binary by barbiergaspard · Pull Request #205 · DataDog/datadog-iac-scanner

barbiergaspard · 2026-06-22T10:27:11Z

Motivation

This PR allows the user to define a local directory from which the IaC rules are fetched. This is useful for testing purposes when changing the rules.

Changes

Added a --queries-path flag
Changed the values of QueriesPath and ChangedDefaultQueryPath scan parameters if the flag is used
Modified the README.md to reflect previous changes

Author Checklist

I have reviewed my own PR.
I have added or updated relevant unit tests where necessary. If no tests are added, I've explained why.
All new and existing tests pass.
I have tested my changes on staging (if applicable).
I have updated any relevant documentation (if applicable).

QA Instruction

Run a scan on your chosen repository
Clone the datadog-iac-scanner-default-rules
Either do some relevant changes to a rule, or choose a subdirectory from the rules repo (not containing every rules that flagged a violation in the first scan)
Rerun the scan using -q QUERYDIR
Verify that the findings are in line with the flag you just used

Blast Radius

This change impacts the query fetching of the IaC scanner

Additional Notes

If you need to share anything else along with your PR, please do it here.

I submit this contribution under the Apache-2.0 license.

barbiergaspard · 2026-06-22T10:27:26Z

Parse a new "arguments" keyword in new IaC v1.4 config #206 : 2 dependent PRs (#217 , #238 )
Add the queries-path flag to the scanner binary #205 👈 (View in Graphite)
main

This stack of pull requests is managed by Graphite. Learn more about stacking.

datadog-prod-us1-6 · 2026-06-22T10:29:56Z

🎯 Code Coverage (details)
• Patch Coverage: 66.67%
• Overall Coverage: 49.41% (+0.08%)

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: 2510df1 | Docs | Datadog PR Page | Give us feedback!}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fced47cbb6

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-06-22T12:32:18Z

+	queriesPath := c.StringSlice("queries-path")
+	changedDefaultQueryPath := len(queriesPath) > 0
+	if !changedDefaultQueryPath {
+		queriesPath = []string{"./assets/queries"}
+	}


Validate custom query paths before disabling defaults

When a user supplies -q with a mistyped or empty directory, this marks the scan as using a custom ruleset and later causes createQuerySource to bypass the Datadog rule source. The filesystem loader only logs missing/unreadable query paths and returns an empty query list, so the scan can complete with zero rules and no findings instead of failing. Please validate the supplied paths or fail when no local queries are discovered for a custom queries-path.

Useful? React with 👍 / 👎.

Just updated the branch to fix this. The scan will now fail in (one of) the provided path(s) is invalid or not a directory

barbiergaspard · 2026-06-24T07:39:43Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ab97dfd288

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-06-24T07:45:19Z

 	var dirs []string
 	for _, src := range s.Source {
-		entries, err := os.ReadDir(src)
+		err := filepath.WalkDir(src, func(path string, d os.DirEntry, err error) error {


Follow symlinked query directories

When --queries-path points at a symlink to a directory, scan.go accepts it because os.Stat follows the symlink, but filepath.WalkDir does not follow symlinks and reports the root entry as non-directory. In that scenario no local rule directories are discovered, so the scan can proceed with zero custom queries and produce a false clean result; resolve the source path or handle a symlinked root before walking it.

Useful? React with 👍 / 👎.

As we discussed on slack, should fix

whitemerch

It might be worth it overall some tests, either a table-driven test like in scan_test.go (or an E2E fixture similar to test/e2e/e2e_test.go) covering at least: valid dir, non-existent path, path-is-a-file, and symlink-to-dir. It's exhaustive, feel free to add more test gaps, but that's what code coverage is made for here, which is to make you assess if the changes you are introducing are safe enough

whitemerch · 2026-06-24T09:42:54Z

--queries-path paths are not resolved to absolute paths, which is wrong.

Maybe you could do like the other params, and do something like:

queriesPath, err = getAbsolutePaths(queriesPath) if err != nil { return errorWithExitCode(fmt.Errorf("invalid queries path: %w", err), constants.InvalidConfigErrorCode) }

whitemerch · 2026-06-24T09:44:55Z

+datadog-iac-scanner scan -p REPODIR -o OUTPUTDIR -q QUERYDIR
+```
+The rule directories in the QUERYDIR directory must contain a 'query.rego' and a 'metadata.json' file. You can also specify multiple paths:
+```bash


There should be a blank line between the paragraph and the fence

whitemerch · 2026-06-24T09:50:10Z

 	var dirs []string
 	for _, src := range s.Source {
-		entries, err := os.ReadDir(src)
+		err := filepath.WalkDir(src, func(path string, d os.DirEntry, err error) error {


As we discussed on slack, should fix

barbiergaspard · 2026-06-24T14:46:42Z

+		evaluated, err := filepath.EvalSymlinks(src)
 		if err != nil {
-			contextLogger.Debug().Msgf("localQueryDirs: skipping %s: %v", src, err)
-			continue


This part puzzled me. Apparently we used to just skip a directory if the path was invalid. To me, it makes more sense to stop there instead of just ignoring the directory, so I changed this part. Lmk if I should revert this

With return nil, if you do -q path1 -q path2 and path1 fails EvalSymlinks, you lose all queries from path2 with no error propagated upward. That's the worst of both worlds: it silently drops valid sources without telling the caller anything failed

whitemerch · 2026-06-24T15:10:10Z

+	changedDefaultQueryPath := len(queriesPath) > 0
+	if !changedDefaultQueryPath {
+		queriesPath = []string{"./assets/queries"}
+	}


validateQueriesPaths already calls getAbsolutePaths, then os.Stat on each result, then checks IsDir. The block immediately after in runScan repeats exactly those two checks on the already-validated queriesPath slice, so you are basically performing a second dead loop

whitemerch · 2026-06-24T15:11:01Z

+	queriesPath := c.StringSlice("queries-path")
+	queriesPath, err = validateQueriesPaths(queriesPath)
+	if err != nil {
+		return errorWithExitCode(fmt.Errorf("invalid queries path %q", err), constants.InvalidConfigErrorCode)


err here is the error value returned by validateQueriesPaths, not a path string. %q formats its argument as a quoted Go string literal, so this would produce something like invalid queries path "invalid queries path "/some/path"", quoting the inner error message rather than wrapping it

whitemerch · 2026-06-24T15:13:29Z

+		evaluated, err := filepath.EvalSymlinks(src)
 		if err != nil {
-			contextLogger.Debug().Msgf("localQueryDirs: skipping %s: %v", src, err)
-			continue


With return nil, if you do -q path1 -q path2 and path1 fails EvalSymlinks, you lose all queries from path2 with no error propagated upward. That's the worst of both worlds: it silently drops valid sources without telling the caller anything failed

whitemerch · 2026-06-24T15:13:45Z

 		if err != nil {
-			contextLogger.Debug().Msgf("localQueryDirs: skipping %s: %v", src, err)
-			continue
+			contextLogger.Debug().Msgf("localQueryDirs: error evaluting %s: %v", src, err)


evaluating, not evaluting

whitemerch · 2026-06-24T15:14:22Z

+			assert.True(t, filepath.IsAbs(got[0]))
+		})
+	}
+}


Missing newline at EOF, and there is an error on the diff actually

whitemerch · 2026-06-24T15:14:42Z

 	}
 }
+
+


nit: keep it one line in between the func, it's the convention

whitemerch

We are almost there!

An existing but empty --queries-path disables default Datadog rules and completes successfully with zero rules. I reproduced this locally with scanner, it exited 0 with 0 rules found 0 violations. That can create false-clean scans when users point at the wrong directory or an empty checkout. Maybe the custom path flow should fail when discovery finds no valid rule directories

whitemerch · 2026-06-25T09:17:08Z

+
+			source := NewFilesystemSource(ctx, src, []string{""}, []string{""}, "", true)
+
+			got, _ := source.localQueryDirs(ctx)


The new localQueryDirs tests discard the returned error, so invalid-path and mixed-path cases don’t actually assert the error propagation this PR relies on. Add wantErr assertions, ideally through GetQueries if you want to lock public behavior

whitemerch · 2026-06-26T11:02:03Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: da03d709ed

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-06-26T11:07:44Z

+		QueriesPath:             queriesPath,
+		ChangedDefaultQueryPath: changedDefaultQueryPath,
+		LibrariesPath:           "./assets/libraries",
+		ReportFormats:           []string{"sarif"},
+		Platform:                selectPlatforms(c.StringSlice("type")),


Preserve custom platforms when using local queries

When -q points at local rules whose metadata platform is supported by the engine but is not in pkg/platforms.Supported (for example OpenAPI, Pulumi, Buildah, or AzureResourceManager), the platform list here still goes through selectPlatforms, which intersects with only the published Datadog platform list and drops those values even if the user passes -t OpenAPI. Because ChangedDefaultQueryPath then switches the scan to FilesystemSource, those local rules are never loaded/scanned; preserve raw custom platform values or use the full parser/source platform set when local queries are selected.

Useful? React with 👍 / 👎.

Thoughts on this @whitemerch ? Not sure this is relevant. It's not really in the scope of this PR, but we could use it to decide if we want to gate the platforms to only the ones WE support, or if we want to allow for arbitrary platform. I'd personally choose the former, but I'm not sure

Not relevant

chatgpt-codex-connector · 2026-06-26T11:07:51Z

💡 Codex Review

datadog-iac-scanner/cmd/scanner/scan.go

Lines 209 to 213 in da03d70

    
           QueriesPath:             queriesPath, 
        
           ChangedDefaultQueryPath: changedDefaultQueryPath, 
        
           LibrariesPath:           "./assets/libraries", 
        
           ReportFormats:           []string{"sarif"}, 
        
           Platform:                selectPlatforms(c.StringSlice("type")),

Preserve custom platforms when using local queries

When -q points at local rules whose metadata platform is supported by the engine but is not in pkg/platforms.Supported (for example OpenAPI, Pulumi, Buildah, or AzureResourceManager), the platform list here still goes through selectPlatforms, which intersects with only the published Datadog platform list and drops those values even if the user passes -t OpenAPI. Because ChangedDefaultQueryPath then switches the scan to FilesystemSource, those local rules are never loaded/scanned; preserve raw custom platform values or use the full parser/source platform set when local queries are selected.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

This allows the user to choose a local query repository to test their own rules.

Change the createServices function to point to a directory containing queries. The localQueryDirs function now returns an error if no queries directory is found. Remove a capital letter from an error message Create custom error in localQueryDirs so that tests are not susceptible to os differences.

barbiergaspard force-pushed the gaspard.barbier/query-path-flag branch 5 times, most recently from 09919ca to fced47c Compare June 22, 2026 12:18

barbiergaspard marked this pull request as ready for review June 22, 2026 12:26

barbiergaspard requested a review from a team as a code owner June 22, 2026 12:26

chatgpt-codex-connector Bot reviewed Jun 22, 2026

View reviewed changes

barbiergaspard mentioned this pull request Jun 22, 2026

Parse a new "arguments" keyword in new IaC v1.4 config #206

Merged

5 tasks

barbiergaspard force-pushed the gaspard.barbier/query-path-flag branch 2 times, most recently from c1a0cdc to ab97dfd Compare June 23, 2026 07:51

chatgpt-codex-connector Bot reviewed Jun 24, 2026

View reviewed changes

whitemerch reviewed Jun 24, 2026

View reviewed changes

barbiergaspard force-pushed the gaspard.barbier/query-path-flag branch from ab97dfd to 8637be8 Compare June 24, 2026 13:39

barbiergaspard commented Jun 24, 2026

View reviewed changes

barbiergaspard force-pushed the gaspard.barbier/query-path-flag branch from 8637be8 to fd6d7a5 Compare June 24, 2026 14:53

whitemerch reviewed Jun 24, 2026

View reviewed changes

barbiergaspard force-pushed the gaspard.barbier/query-path-flag branch 3 times, most recently from fb2dff3 to 39aba83 Compare June 25, 2026 08:48

whitemerch reviewed Jun 25, 2026

View reviewed changes

barbiergaspard force-pushed the gaspard.barbier/query-path-flag branch from 39aba83 to da03d70 Compare June 25, 2026 10:22

chatgpt-codex-connector Bot reviewed Jun 26, 2026

View reviewed changes

Add the queries-path flag to the scanner binary

f4324d9

This allows the user to choose a local query repository to test their own rules.

barbiergaspard force-pushed the gaspard.barbier/query-path-flag branch from da03d70 to f4324d9 Compare June 26, 2026 13:49

barbiergaspard force-pushed the gaspard.barbier/query-path-flag branch from 05001e3 to 2510df1 Compare June 26, 2026 15:02

whitemerch approved these changes Jun 29, 2026

View reviewed changes

barbiergaspard merged commit 728e9a8 into main Jun 29, 2026
19 checks passed

barbiergaspard deleted the gaspard.barbier/query-path-flag branch June 29, 2026 06:58

This was referenced Jun 29, 2026

Adding comments for a simple CI test #217

Closed

Add arguments to rule metadata #238

Merged


		source := NewFilesystemSource(ctx, src, []string{""}, []string{""}, "", true)

		got, _ := source.localQueryDirs(ctx)

Uh oh!

Conversation

barbiergaspard commented Jun 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation

Changes

Author Checklist

QA Instruction

Blast Radius

Additional Notes

Uh oh!

barbiergaspard commented Jun 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

datadog-prod-us1-6 Bot commented Jun 22, 2026 • edited by datadog-prod-us1-4 Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jun 22, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

barbiergaspard commented Jun 24, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jun 24, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

whitemerch left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

barbiergaspard Jun 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

whitemerch left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

whitemerch commented Jun 26, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jun 26, 2026

Choose a reason for hiding this comment

Uh oh!

barbiergaspard commented Jun 22, 2026 •

edited

Loading

barbiergaspard commented Jun 22, 2026 •

edited

Loading

datadog-prod-us1-6 Bot commented Jun 22, 2026 •

edited by datadog-prod-us1-4 Bot

Loading

barbiergaspard Jun 24, 2026 •

edited

Loading