feat(datasecurity): emit sdsresult (part 1)

Author: aimenebelfodil

Cargo.lock

@@ -4,6 +4,7 @@ version = "0.1.0"
 edition.workspace = true
 license.workspace = true
 rust-version.workspace = true
+build = "build.rs"
 
 [features]
 default = ["engine-postgres"]
@@ -15,17 +16,24 @@ engine-postgres = [
 
 [dependencies]
 anyhow.workspace = true
-core = { path = "../../core" }
+# Aliased to `shlib_core` so the crate name does not shadow the std `core`
+# crate, whose `::core::` paths are referenced by the prost-generated proto code.
+shlib_core = { path = "../../core", package = "core" }
 # Keep only the `dd-sds` feature and disable default features so we pull in just
 # the necessary dependencies and avoid shipping the third-party checkers.
 dd_sds = { package = "dd-sensitive-data-scanner", version = "=0.1.0-20260715-fcd8f9716b61", default-features = false, features = ["dd-sds"] }
 libc.workspace = true
 serde.workspace = true
 serde_json.workspace = true
+prost.workspace = true
+prost-types.workspace = true
 
 # postgres engine (gated behind the `engine-postgres` feature)
 postgres = { version = "0.19", optional = true }
 
+[build-dependencies]
+prost-build = "0.14"
+
 [dev-dependencies]
 serde_yaml = "0.9.34"
 

pkg/collector/sharedlibrary/rustchecks/checks/datasecurity/Cargo.toml

@@ -0,0 +1,21 @@
+// Unless explicitly stated otherwise all files in this repository are licensed
+// under the Apache License Version 2.0.
+// This product includes software developed at Datadog (https://www.datadoghq.com/).
+// Copyright 2026-present Datadog, Inc.
+
+// Compiles the canonical SDS result proto with prost-build so the check can
+// serialize `SdsResultPayload` messages. The crate is built with cargo.
+//
+// Canonical source: pkg/proto/datadog/sds/sds_result.proto
+// Requires `protoc` on PATH (e.g. `brew install protobuf`).
+
+fn main() -> Result<(), Box<dyn std::error::Error>> {
+    let proto_root = "../../../../../proto";
+    let proto_file = "../../../../../proto/datadog/sds/sds_result.proto";
+
+    println!("cargo:rerun-if-changed={proto_file}");
+
+    prost_build::compile_protos(&[proto_file], &[proto_root])?;
+
+    Ok(())
+}

pkg/collector/sharedlibrary/rustchecks/checks/datasecurity/build.rs

@@ -0,0 +1,4 @@
+//! Agent metadata constants for SDS result payloads.
+
+/// Event platform track type for SDS results (matches Go `EventTypeSDSResult`).
+pub const SDS_RESULT_EVENT_TYPE: &str = "sds-result";

pkg/collector/sharedlibrary/rustchecks/checks/datasecurity/src/constants.rs

@@ -5,7 +5,9 @@ mod check;
 use check::check;
 
 mod config;
+mod constants;
 mod payload;
+mod proto;
 mod scanning;
 mod version;
 use version::VERSION;

pkg/collector/sharedlibrary/rustchecks/checks/datasecurity/src/lib.rs

@@ -0,0 +1,53 @@
+//! Protobuf construction for SDS results.
+//!
+//! The crate is built with cargo: `build.rs` compiles
+//! `pkg/proto/datadog/sds/sds_result.proto` with prost-build and this module
+//! includes the generated code from `OUT_DIR`. The check builds these
+//! prost-generated types directly (no intermediate structs).
+
+use std::time::SystemTime;
+
+use prost::Message;
+use prost_types::Timestamp;
+
+use crate::payload::Match;
+
+pub mod datadog {
+    pub mod sds {
+        include!(concat!(env!("OUT_DIR"), "/datadog.sds.rs"));
+    }
+}
+
+// Proto types the check assembles directly.
+pub use datadog::sds::{
+    scanning_source,
+    sds_result_payload::{
+        scan_location,
+        scan_metadata::{scan_task_metadata::Status, ScanTaskMetadata},
+        PostgresTable, Resource, ScanLocation, ScanMetadata, ScanResult, TableMatch,
+    },
+    ScanningSource, SdsResultPayload,
+};
+
+/// Convert aggregated scanner matches into proto `TableMatch` entries.
+pub fn table_matches(matches: &[Match]) -> Vec<TableMatch> {
+    matches
+        .iter()
+        .map(|m| TableMatch {
+            rule_id: m.rule_id.clone(),
+            column_name: m.column_name.clone(),
+            count_matched_rows: m.count_matched_rows,
+            ..Default::default()
+        })
+        .collect()
+}
+
+/// Convert a wall-clock time into a proto `Timestamp`.
+pub fn to_timestamp(time: SystemTime) -> Timestamp {
+    Timestamp::from(time)
+}
+
+/// Marshal `payload` to protobuf bytes for the `sds-result` event platform track.
+pub fn encode(payload: &SdsResultPayload) -> Vec<u8> {
+    payload.encode_to_vec()
+}