Motivation

Bring IaC scanning into the Datadog IDE extensions, the same way SAST and secret scanning already work.

Today the scanner is a one-shot CLI (requires a git remote, fetches rules from the API per scan, reads files from disk, writes SARIF) — unsuitable for an IDE. The extension needs a long-lived, pure-engine HTTP server it can drive by pushing rules + file content over HTTP, mirroring the datadog-static-analyzer-server contract so it can reuse the same binary-manager lifecycle (keep-alive ping, graceful shutdown, version discovery).

JIRA Ticket: K9CODESEC-2453

Changes

serve is purely additive. The scan CLI is unchanged, and the virtual-FS refactor is behavior-preserving (the CLI uses a DiskFS passthrough).

• serve command + lifecycle mirroring the static-analyzer server: flags --port / --address / --keep-alive-timeout / --enable-shutdown (--use-rules-cache accepted as a no-op); GET /ping→pong, GET /version & /revision, GET|POST /shutdown (204/403), keep-alive idle-exit goroutine, X-iac-scanner-server-* + CORS headers.
• GET /ide/v1/iac/supported-files — static {patterns, strategy} map (directory vs single_file), derived from analyzer.PossibleFileTypes() with a drift test.
• POST /ide/v1/iac/analyze — content-push scan. Request {files:[{path,content}], rules, config} (raw content); response {findings, missing_files, failed_queries}. No git, no network, no SARIF.
• Content-push + virtual FS — new pkg/vfs (FS / DiskFS / MemFS). MemFS resolves Terraform siblings, vars, and local modules in memory and records referenced-but-unpushed paths as workspace-relative missing_files (the hybrid-escalation signal; CWD-independent, so one server can serve many workspaces). New MemorySourceProvider feeds pushed files to the engine instead of walking disk. vfs.FS is threaded through the Terraform parser/data-source/modules, the inspector, and extension detection.
• scan.Client seams — Client.Scan(ctx) (in-memory results) plus WithFS / WithQuerySourceFactory / WithInMemoryScan options, and an in-memory initScan branch that bypasses the disk analyzer.

Author Checklist

• I have reviewed my own PR.
• I have added or updated relevant unit tests where necessary. If no tests are added, I've explained why.
• All new and existing tests pass.
• I have tested my changes on staging (if applicable).
• I have updated any relevant documentation (if applicable).

QA Instruction

The server needs the Rego support libraries on disk; rules and file content are pushed per request.

go build -o /tmp/iac-scanner ./cmd/scanner
/tmp/iac-scanner serve --port 49200 --enable-shutdown --libraries-path ./assets/libraries

• curl 127.0.0.1:49200/ping → pong; GET /ide/v1/iac/supported-files → the {patterns,strategy} array.
• POST /ide/v1/iac/analyze: fetch rules anonymously from GET https://api.datadoghq.com/api/v2/static-analysis/iac/rulesets/default-ruleset (base64-decode each rego_query, lowercase platform). Push a Terraform main.tf that uses var.x defined in a sibling variables.tf → expect findings, with var.x resolved (proves in-memory sibling resolution). Push a module { source = "../mod" } whose directory you don't send → expect "mod" to appear in missing_files as a workspace-relative path.
• CLI regression: datadog-iac-scanner scan … SARIF output must be unchanged (DiskFS path is behavior-preserving).
• Concurrency: go build -race, then fire several parallel /analyze requests — no DATA RACE in the log and the process must not exit 66.

Blast Radius

Only datadog-iac-scanner. serve is additive; the scan CLI and its SARIF output are unchanged (the vfs refactor is a DiskFS passthrough, covered by the existing suite). No backend/API changes.

Additional Notes

• Deferred: Helm rendering is disabled in content-push mode (the Helm SDK needs a real chart directory) — pushed charts fall back to raw-YAML scanning; the $ref/include resolver isn't virtualized yet (niche OpenAPI/Ansible cross-file refs).

I submit this contribution under the Apache-2.0 license.