Motivation

Rego libraries were previously embedded in the scanner binary via go:embed and served as a fallback when the backend was unavailable. The libraries are now managed and pushed to the backen, making the embedded copy redundant and a source of drift. This PR removes the embedded libraries entirely and makes the backend the sole delivery path, with --libraries-path as an explicit local override for development or custom deployments.

Changes

Library delivery

Removed all files under assets/ (18 .rego files, common.json, and 4 *_test.rego files). The assets package no longer embeds anything. The OPA unit tests for library helper functions have been ported to the default-rules repository.

Backend source

DatadogSource.GetQueryLibrary now normalizes platform names to lowercase on both storage and lookup, fixing a case mismatch (cloudFormation vs cloudformation) that was previously masked by the embedded fallback. The auto-fallback to embedded libraries in NewDatadogSource is removed; the only library fallback path is when --libraries-path is explicitly set.

Filesystem source

FilesystemSource.GetQueryLibrary now reads .rego and .json files directly from disk instead of delegating to the embedded assets package.

Scan wiring

pkg/scan/scan.go only adds a local library fallback source when ChangedDefaultLibrariesPath is true (i.e. --libraries-path was explicitly passed). Without that flag, the scanner always fetches libraries from the backend.

CLI commands

list-queries, test-rules, and custom Rego evaluation (custom.go) all use DatadogSource for library access instead of the embedded filesystem.

E2E tests

Removed useLocalLibraries helper and the testdata/libraries/ snapshot. E2E tests now fetch libraries from the public backend endpoint (/api/v2/static-analysis/iac/libraries), which requires no authentication.

Tooling

Removed .github/scripts/update_versions/, the update_software_versions workflow, rules_generator/classes/CodeProcessor.py methods that read/wrote common.json now raise NotImplementedError (are they even used? Anyways if so they would need to be ported separetly, and in a different way)

Author Checklist

• I have reviewed my own PR.
• I have added or updated relevant unit tests where necessary.
• All new and existing tests pass.
• I have tested my changes on staging (if applicable).
• I have updated any relevant documentation (if applicable).

QA Instruction

Build the binary and run a scan against any Terraform fixture, libraries are now fetched from the backend automatically:

go build -o bin/datadog-iac-scanner ./cmd/scanner
./bin/datadog-iac-scanner scan -p <path-to-terraform-dir>

Confirm no library not found errors appear. To test the explicit local override path:

./bin/datadog-iac-scanner serve --libraries-path <path-to-local-libraries>

Blast Radius

Affects the scanner binary only. The backend library endpoint is public and requires no authentication

Additional Notes

Companion PR in default-rules: https://github.com/DataDog/datadog-iac-scanner-default-rules/pull/71 (ports the OPA library tests, fixes tool.sh test to read libraries from disk, bumps scanner dependency to v1.7.0).

I submit this contribution under the Apache-2.0 license.