Documentation
¶
Overview ¶
Package server implements a long-lived HTTP server that analyzes IaC files on demand. It mirrors the contract of the Rust datadog-static-analyzer-server so the Datadog VS Code extension can manage both binaries through the same lifecycle (keep-alive ping, graceful shutdown, version discovery).
The server is a pure engine: it never reads git, calls the Datadog API, or writes SARIF. Rules and file content are pushed over HTTP by the extension.
Lifecycle endpoints (this file):
GET /ping health / keep-alive (resets the idle timer), returns "pong" GET /version running binary version (plain text) GET /revision running binary commit (plain text) POST /shutdown graceful shutdown (204 when --enable-shutdown, else 403) GET /shutdown same as POST
IaC endpoints (GET /ide/v1/iac/supported-files, POST /ide/v1/iac/analyze) are registered here and implemented in sibling files.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
Address string // bind address (default 127.0.0.1)
Port int // listen port (default 8000)
KeepAliveTimeout time.Duration // idle timeout; 0 disables auto-shutdown
EnableShutdown bool // gate for the /shutdown endpoint
LibrariesPath string // Rego support libraries
QueriesPath string // default rule corpus (used only when a request omits rules)
// MaxConcurrentAnalyze caps simultaneous /analyze scans. <= 0 applies
// defaultMaxConcurrentAnalyze.
MaxConcurrentAnalyze int
// DisableRuleIsolation opts into the engine's shared-compiler mode (rules +
// libraries co-compiled once) instead of isolating each rule. Lowers memory
// substantially at the cost of per-rule compile-failure isolation.
DisableRuleIsolation bool
// UseRulesCache enables the process-global compiled-query cache so repeated
// /analyze scans reuse compiled rules (warm scans skip recompilation, at the
// cost of retained memory). Maps to the --use-rules-cache server flag.
UseRulesCache bool
// ParallelParsing fans the per-file parse across CPUs for pushed content.
// Measured ~26% faster wall-clock on a 950-file push; same CPU total. Maps
// to the experimental --x-parallelparsing server flag.
ParallelParsing bool
// WriteTimeout bounds how long writing a response may take, so a client that
// stops reading cannot hold a handler goroutine indefinitely. Zero applies
// defaultWriteTimeout; a NEGATIVE value disables the timeout entirely (mapped
// to http.Server.WriteTimeout = 0). Maps to the --write-timeout server flag.
WriteTimeout time.Duration
// MaxFiles caps the number of files in a single /analyze request. <= 0
// applies defaultMaxFiles. Maps to the --max-files server flag.
MaxFiles int
// MaxRequestBytes caps the JSON-encoded /analyze request body. <= 0 applies
// defaultMaxRequestBytes. Maps to the --max-request-mib server flag.
MaxRequestBytes int64
}
Config holds the server's runtime settings, populated from the serve command's flags.
type Server ¶
type Server struct {
// contains filtered or unexported fields
}
Server is the IaC analysis HTTP server.
type SupportedFileEntry ¶
type SupportedFileEntry struct {
Patterns []string `json:"patterns"`
Strategy fileStrategy `json:"strategy"`
}
SupportedFileEntry maps a set of file patterns to a resolution strategy. This is the IaC analog of the static analyzer's GET /languages.