POC: Pulumi multi-language IaC parsing support#237
Draft
whitemerch wants to merge 1 commit into
Draft
Conversation
…ript, JavaScript, and Go resource definitions for Rego evaluation.
|
🎯 Code Coverage (details) 🔗 Commit SHA: 4495d15 | Docs | Datadog PR Page | Give us feedback! |
whitemerch
changed the base branch from
main
to
chakib.hamie/polyglot_repo_optimization
July 4, 2026 13:55
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
The scanner has no first-class support for Pulumi programs written in Python, TypeScript, JavaScript, or Go. This POC explores parsing those sources into a normalized YAML-like document shape so existing Rego rules can evaluate Pulumi resources without a separate rule set per language.
The branch also includes a single-repository walk optimization that feeds a shared file cache and project index into the new parsers.
Changes
Scan pipeline
The analyzer walks the repository once, caches file contents, and exposes inventory metadata so parsers can resolve cross-file symbols without re-reading the tree.
Pulumi platform (POC)
New parsers for Python, TypeScript, JavaScript, and Go extract Pulumi resource constructor calls and emit documents compatible with the existing Pulumi YAML rule format. A project index maps exported constants, variables, and zero-argument helper functions across sibling files. Static resolution covers literals, config defaults, imports, object spreads, type assertions, string concatenation, and locally defined helper calls.
Integration
Parsers register through the existing prepare path and attach to the scan pipeline behind new model kinds for each language.
QA Instruction
GOFLAGS="-mod=mod" go test ./pkg/parser/pulumi/...go test ./pkg/analyzer/... ./pkg/runner/...Impact
POC only. Adds new parser packages and scan wiring; does not ship production-ready Pulumi rule coverage. The repository-walk changes affect all platforms that use the shared filesystem provider.