Motivation

Add KICS-aligned CPU and memory profiling support to help investigate scanner performance and memory footprint by scan phase.

JIRA Ticket K9CODESEC-2331

Changes

• Added global --profiling CPU|MEM support.
• Added profiling around major scan phases, including query loading, source preparation, scan execution, analysis, and report generation.
• Based the implementation on KICS metrics/profiling behavior.
• Improved on KICS by writing per-phase pprof files to the system temp directory for direct go tool pprof inspection.
• Improved MEM profiling clarity by logging live heap after each phase, since heap profiles are whole-process snapshots rather than phase-local allocation totals.
• Updated profiling documentation with go tool pprof examples.

Author Checklist

• I have reviewed my own PR.
• I have added or updated relevant unit tests where necessary. If no tests are added, I've explained why.
• All new and existing tests pass.
• I have tested my changes on staging (if applicable).
• I have updated any relevant documentation (if applicable).

QA Instruction

Run a scan with profiling enabled:

./bin/datadog-iac-scanner --profiling CPU scan -p <path>
./bin/datadog-iac-scanner --profiling MEM scan -p <path>

Verify that phase totals are logged and that pprof files are written to the temp directory. For MEM, confirm logs say Total MEM live heap after ... and inspect profiles with go tool pprof.

Blast Radius

Limited to Datadog IaC Scanner CLI profiling behavior and related documentation. Normal scans are unchanged unless --profiling is enabled.

Additional Notes

No new unit tests were added; this change is exercised through CLI profiling runs and produces runtime pprof artifacts/log output.

I submit this contribution under the Apache-2.0 license.