Migrate SAST config to code-security.datadog.yaml

[kikoveiga]

Summary

• Rename static-analysis.datadog.yaml (legacy schema, and mismatched filename/extension for that schema) to code-security.datadog.yaml on the current schema-version: v1.0 format
• Fix an indentation bug in the old file where typescript-best-practices's rules: key was a sibling of the ruleset entry instead of nested under it, so the no-console ignore-paths never actually applied
• use-default-rulesets: false is set explicitly to preserve the legacy behavior, where the listed rulesets were the complete set run (no implicit defaults)

Test plan

• Parsed the new file with PyYAML to confirm the nested structure resolves as expected (no-console and no-new rule-configs both correctly nested)
• Confirm the ruleset actually picks up the file once Datadog next scans this repo

[cursor]

PR Review — Score: 4.9 / 5

This is a well-scoped SAST configuration migration: the legacy static-analysis.datadog.yaml is replaced with the current code-security.datadog.yaml v1.0 schema, the typescript-best-practices indentation bug is fixed so no-console ignore paths are actually nested under that ruleset, and use-default-rulesets: false preserves the prior “only these two rulesets” behavior. I would approve.

Why 4.9: The YAML structure is valid (verified via PyYAML), rule and global ignore paths match the old file, and the PR description accurately explains the schema and behavioral intent. No SDK runtime, API, or test code is touched.

Why not 5: The remaining gap is operational confirmation that Datadog’s scanner discovers code-security.datadog.yaml on the next repo scan (already noted in the test plan). That is outside what we can verify from the diff alone.

---

CI was still running on some dd-gitlab/* jobs when this review was posted; that is noted for context only and is not a review finding.

  

_{Sent by Cursor Automation: electron-sdk reviews}