Include Helm chart CRD manifests in scan coverage

[whitemerch]

Motivation

Helm charts can ship CustomResourceDefinitions under crds/, but the scanner did not analyze them. The Helm dry-run client omitted CRDs from rendered output (IncludeCRDs = false), and those files were also excluded from the filesystem walk after a successful chart render.

Changes

Helm resolver

Enable IncludeCRDs so CRD manifests are part of the rendered output. Stamp YAML CRD files with KICS_HELM_ID markers for line mapping, include CRD files in source mapping (including subcharts), and map rendered CRD splits back to their originals when Helm omits inline markers. Multi-document CRD files are handled by attributing sourceless splits to the last known source when they look like a real manifest, and by picking the Nth stamped marker for the Nth document from the same file.

JSON CRDs

JSON CRD files are included in scan output but are not stamped (YAML comments would corrupt JSON); findings are reported with degraded line attribution.

Author Checklist

• I have reviewed my own PR.
• I have added or updated relevant unit tests where necessary. If no tests are added, I've explained why.
• All new and existing tests pass.
• I have updated any relevant documentation (if applicable).

QA Instruction

1. go test ./pkg/resolver/helm/...
2. make build && ./bin/datadog-iac-scanner scan -p test/fixtures/test_helm_with_crds -t Kubernetes -o /tmp/helm-crd-out — CRD resources from crds/ should appear in SARIF; no duplicate raw-template findings from templates/.
3. Scan test/fixtures/test_helm_subchart and confirm the subchart CRD under charts/subchart/crds/ is resolved.

Impact

Affects CLI scans of repositories that include Helm charts with crds/. YAML CRDs gain full scan coverage and line mapping; JSON CRDs are scanned with degraded line precision. No changes to rule definitions or SARIF schema.

Additional Notes

I submit this contribution under the Apache-2.0 License.

[datadog-datadog-prod-us1-2]

✨ Fix all issues with BitsAI

⚠️ Warnings

🚦 2 Pipeline jobs failed

go-ci | lint     

🔧 Fix in code (Fix with Cursor).

goconst error: string '.yaml' has 2 occurrences, make it a constant at pkg/resolver/helm/helm.go:170

go-ci | unit-tests (1.25.x, windows-2022)     

🔧 Fix in code (Fix with Cursor).

3 failed tests. Error: 'map[]' should have 2 item(s), but has 0 in TestHelm_Resolve_WithCRDs; '[]' should have 2 item(s), but has 0 in TestHelm_Resolve_MultiDocCRD; should be true in TestHelm_Resolve/test_with_dependencies.

ℹ️ Info

🎯 Code Coverage (details)
• Patch Coverage: 98.00%
• Overall Coverage: 48.00% (+0.19%)

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 865e4e2 | Docs | Datadog PR Page | Give us feedback!}