Motivation

The parsed document AST uses _kics_line, _kics_lines, _kics_filter_expr etc. as field names, inherited from KICS. Nine rules in datadog-iac-scanner-default-rules reference these keys directly in Rego. This renames them to _dd_* while keeping both old and new fields emitted during migration so the two repos can be deployed independently.

Changes

Parsers (retrocompat — both keys emitted)

docker.Command and buildah.Command now emit both _kics_line (legacy) and _dd_line. jsonfilter.AWSJSONFilter emits both _kics_filter_expr (legacy) and _dd_filter_expr. Old rules using the legacy keys continue to produce findings.

Parsers (direct rename — internal keys, no rego visibility)

_kics_lines → _dd_lines, _kics__default → _dd__default, _kics_arr → _dd_arr across all converters (Terraform, gRPC, JSON, YAML, Bicep) and model.LineObject JSON tags.

Detector

All _kics_* path strings in pkg/detector/search_line_detector.go updated to _dd_*.

Tests

Test fixtures and inline assertions updated to reflect both old and new keys where retrocompat applies; struct and marshal tests updated to compare only the canonical new field.

QA Instruction

1. go test ./pkg/parser/... ./pkg/detector/... ./pkg/model/... ./pkg/kics/...
2. Run a full scan against a Terraform + Dockerfile fixture and confirm line numbers are reported correctly.
3. To verify backward compat: temporarily revert one Dockerfile rego rule to _kics_line and confirm findings still appear.

Impact

Affects every parser's document output. No change in scan findings — both field names are present in the document during migration. The companion rules PR updates the 9 rego rules that reference these keys directly.