[K9VULN-11259] Implement Config V2 by jasonforal · Pull Request #809 · DataDog/datadog-static-analyzer

jasonforal · 2026-02-10T00:10:13Z

Note

The commits are additive and tightly-scoped. You'll want to review commit-by-commit.

What this PR does

Fully implements the config v2 schema (switching all internal logic to operate on v2 data structures):
- The main analyzer (datadog-static-analyzer and git hook)
- The IDE extension (datadog-static-analyzer-server endpoints for config editing)
- The server (datadog-static-analyzer-server POST requests to /analyze)
Artificially disables v2 parsing unless the code is running in a unit test. This lets us ensure test coverage of all the v2 changes without making them public to users.
- This is done because merging with remote configuration requires the analyzer to send its local configuration. The backend has not implement v2 yet, so it will always error.

Summary

For both v1 and v2, parsing a configuration file happens in two stages. 1) The file is parsed into a "YamlConfigFile" struct. Then, that struct is translated into a "ConfigFile".

If a configuration file is a v1 file, it gets convert from a file_v1::YamlConfigFile to a file_v2::YamlConfigFile (operating at this level this makes it easy to provide a CLI tool to convert files):

datadog-static-analyzer/crates/cli/src/config_file.rs

Lines 56 to 59 in e495f67

    
           let local_config: Option<file_v2::ConfigFile> = local_yaml.map(|v| match v { 
        
               WithVersion::V1(v1) => file_v2::YamlConfigFile::from(v1).into(), 
        
               WithVersion::V2(v2) => v2.into(), 
        
           });

From there, a file_v2::YamlConfigFile is always translated into a file_v2::ConfigFile, which all program logic uses.

Notes for reviewer

For the IDE, the only relevant commits are:

400b164, which switches the implementation to use an enum, holding either a v1 config or v2 config. This allows for the IDE to perform all actions (ignoring rules, etc.) on either a v1 or v2 config.

ff4df07 adds tests for v2 alongside the existing v1 tests. Note: not all tests are required for v2. I've added notes where v2 tests were omitted, e.g.:

datadog-static-analyzer/crates/bins/src/bin/datadog_static_analyzer_server/ide/configuration_file/static_analysis_config_file.rs

Lines 873 to 876 in ff4df07

    
           // NOTE: 
        
           // Translating this specific test is not required for v2 because 
        
           // `it_keeps_existing_properties_when_ignoring_other_rules` already demonstrates 
        
           // (`only-paths` and `severity` are conceptually the same: properties of a RuleConfig)

For the analyzer, please:

Check that the v1 -> v2 YAML conversion logic is correct and that the tests are exhaustive. (949f6e1)
e495f67 converts the datadog-static-analyzer binary to use v2 structs under the hood. Check that
- ...there are no regressions in default (unconfigured) settings (e.g. confirm that v1's "ignore-gitignore" defaulting to false has the same logical effect as v2's "use-gitignore" defaulting to true)
- ...the behavior with fetching default rulesets is logically correct (some details have changed -- e.g. we no longer use the presence of a config file to determine whether to fetch default rulesets or not)
- ...duplicate rulesets are not submitted to the analyzer (e.g. a v2 that lists "java-security" in use-rulesets, but "java-security" also exists in the default ruleset list.

What's Next

Once the backend implements v2:

f95139e will be reverted.
v2 configuration files will be added to all integration tests.

(At this point, we can start using v2 everywhere)

schema.json will be updated to include v2.
Docs will be updated.

…ions

…t not within unit tests)

datadog-official · 2026-02-10T00:15:45Z

🎯 Code Coverage
• Patch Coverage: 82.71%
• Overall Coverage: 84.97% (+0.10%)

View detailed report

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: e7e3d79 | Docs | Datadog PR Page | Was this helpful? Give us feedback!}

jacobotb · 2026-02-10T20:47:48Z

...src/bin/datadog_static_analyzer_server/ide/configuration_file/static_analysis_config_file.rs

+                    .use_rulesets
+                    .get_or_insert_with(|| Vec::with_capacity(rulesets.len()));
+                for ruleset_name in rulesets {
+                    // if list.iter().find(|&name| ruleset_name.as_ref() ==)


jacobotb · 2026-02-10T20:49:52Z

...src/bin/datadog_static_analyzer_server/ide/configuration_file/static_analysis_config_file.rs

 }
+
+// test behaviors
+// add empty rulesets  to v2 doesn't instantiate a use_rulesets


robertohuertasm-datadog · 2026-02-11T14:58:34Z

...src/bin/datadog_static_analyzer_server/ide/configuration_file/static_analysis_config_file.rs

-                || prettify_yaml(&fixed),
-                |original_content| reconcile_comments(original_content, &fixed, true),
+                || prettify_yaml(&yaml),
+                |original_content| reconcile_comments(original_content, &yaml, true),


The reconcile_comments function may not work with V2 structure. The test may only care about V1, so the fact that they pass may not indicate that it works with V2 as well. We should probably extend the tests to cover v2 as well.

robertohuertasm-datadog

LGTM! 🚀

jasonforal added 12 commits February 9, 2026 15:49

Impl Default

3a750d6

Add Clone impls

03a4a14

Don't import anyhow::Result

0546e00

Adjust visibilities

7fa3a31

Add conversion for v1 YAML structs to v2

949f6e1

Don't convert to ConfigFile struct during tests that only test parsing

4bd7539

Move ConfigFile from common to file_v1

6aedf34

Implement parse_any_schema_yaml with support for v1 and v2

6169fbe

Refactor StaticAnalysisConfigFile to handle both v1 and v2 configurat…

400b164

…ions

Add tests for all v2 IDE functions

ff4df07

Use v2 ConfigFile data structures to power CLI and Git hook

e495f67

Temporary: artificially disable v2 config parsing in all binaries (bu…

f95139e

…t not within unit tests)

jasonforal requested review from a team as code owners February 10, 2026 00:10

jasonforal requested a review from m-paternostro February 10, 2026 00:10

jacobotb approved these changes Feb 10, 2026

View reviewed changes

robertohuertasm-datadog reviewed Feb 11, 2026

View reviewed changes

Add forgotten test, delete code remnant

e7e3d79

robertohuertasm-datadog approved these changes Feb 12, 2026

View reviewed changes

jasonforal merged commit e520c24 into main Feb 17, 2026
98 of 99 checks passed

jasonforal deleted the jf/K9VULN-11259 branch February 17, 2026 19:16

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[K9VULN-11259] Implement Config V2#809

[K9VULN-11259] Implement Config V2#809
jasonforal merged 13 commits intomainfrom
jf/K9VULN-11259

jasonforal commented Feb 10, 2026

Uh oh!

datadog-official bot commented Feb 10, 2026 •

edited by datadog-datadog-prod-us1 bot

Loading

Uh oh!

jacobotb Feb 10, 2026

Uh oh!

jacobotb Feb 10, 2026

Uh oh!

robertohuertasm-datadog Feb 11, 2026 •

edited

Loading

Uh oh!

robertohuertasm-datadog left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	let local_config: Option<file_v2::ConfigFile> = local_yaml.map(\|v\| match v {
	WithVersion::V1(v1) => file_v2::YamlConfigFile::from(v1).into(),
	WithVersion::V2(v2) => v2.into(),
	});

	// NOTE:
	// Translating this specific test is not required for v2 because
	// `it_keeps_existing_properties_when_ignoring_other_rules` already demonstrates
	// (`only-paths` and `severity` are conceptually the same: properties of a RuleConfig)

Conversation

jasonforal commented Feb 10, 2026

What this PR does

Summary

Notes for reviewer

What's Next

Uh oh!

datadog-official bot commented Feb 10, 2026 • edited by datadog-datadog-prod-us1 bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jacobotb Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

jacobotb Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

robertohuertasm-datadog Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

robertohuertasm-datadog left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

datadog-official bot commented Feb 10, 2026 •

edited by datadog-datadog-prod-us1 bot

Loading

robertohuertasm-datadog Feb 11, 2026 •

edited

Loading