Motivation

A per-query wall-clock timeout (--timeout) was bounding rego eval + result decode. Under worker contention this cut queries off at a timing-dependent point, producing non-deterministic finding counts and silently dropping findings (the same class of bug addressed for decode in #209). Rather than tuning the timeout, we want queries to run to completion and instead surface slow rules via logs so they can be debugged/optimized later — without failing the scan.

This deprecates and disables --timeout, removes query time-bounding, and adds slow-rule logging.

JIRA Ticket: https://datadoghq.atlassian.net/browse/K9CODESEC-2452 (follow-up to #209 / K9CODESEC-2411)

Changes

• pkg/engine/inspector.go
  • Removed the per-query timeout: doRun no longer wraps eval in context.WithTimeout; eval runs on the scan context and is only stopped by real scan cancellation. Removed the queryExecTimeout field/computation/log.
  • Added non-enforcing slow-rule logging: times eval + decode and, past slowQueryWarnThreshold (60s), emits a structured Warn (event=slow_rule, queryID, platform, evalMs, decodeMs, totalMs, thresholdMs). The query always completes — it is never failed or dropped for being slow.
• cmd/scanner/scan.go — --timeout is now hidden and marked (DEPRECATED); logs a deprecation warning when set; no longer wired into scan parameters.
• pkg/scan/client.go — Parameters.QueryExecTimeout marked Deprecated: ignored (kept for struct/CLI compatibility).

Author Checklist

• I have reviewed my own PR.
• I have added or updated relevant unit tests where necessary. If no tests are added, I've explained why.
• All new and existing tests pass.
• I have tested my changes on staging (if applicable).
• I have updated any relevant documentation (if applicable).

No new unit test: the change removes a code path (timeout enforcement) and adds observability logging; behavior is covered by existing engine/scan tests, and the removed e2e-cli-056 no longer applies.

QA Instruction

• Scan a large repo several times — finding counts are stable run-to-run (no timeout-driven variance), and no query is aborted.
• Run with --timeout 5 (or any value) — you should see a deprecation warning (the --timeout flag is deprecated and no longer has any effect…) and identical results to running without it.
• If a rule is genuinely slow (eval + decode > 60s), confirm a single structured log line with event=slow_rule and the *Ms fields appears; the scan still completes normally.

Blast Radius

DataDog IaC Scanner only (query engine + CLI). Behavioral change: queries are no longer time-bounded, so a single pathological rule could run longer than before (mitigated by logging, and bounded by overall scan/process lifecycle). --timeout remains accepted for backward compatibility but has no effect. No change to which findings are produced for normal rules.

Additional Notes

I submit this contribution under the Apache-2.0 license.