Motivation

When the same local Terraform module is instantiated from more than one caller, the resources it produces are attributed to the module body file and share the same finding fingerprint (repository, file path, resource type/name, rule id). Distinct module calls therefore collide and collapse into a single finding, hiding per-caller context and the per-call resolved values.

This stacks on top of #193 and folds the module call chain into the fingerprint so each caller yields its own finding.

JIRA Ticket: K9VULN-16354

Changes

• Each instantiated local-module resource now gets a per-caller synthetic document (id = file id + call chain + instance) backed by a lightweight synthetic file entry that carries the module call chain; the document keeps an empty body so it is not re-scanned.
• The call chain is propagated through the vulnerability and the SARIF VulnerableFile, and folded into the Datadog fingerprint via GetDatadogFingerprintHash. When the chain is empty (every non-module finding) the hash is byte-identical to before, so existing fingerprints are unchanged.
• The module evaluation cache is now keyed by the call chain in addition to dir/address/inputs, so two distinct callers passing identical inputs are evaluated separately instead of sharing the first caller's resolved resources and call chain.

Author Checklist

• I have reviewed my own PR.
• I have added or updated relevant unit tests where necessary. If no tests are added, I've explained why.
• All new and existing tests pass.
• I have tested my changes on staging (if applicable).
• I have updated any relevant documentation (if applicable).

QA Instruction

Scan a repo where two root stacks call the same local module (even with identical inputs). Confirm two findings are produced, each attributed to the module body file with a distinct fingerprint, instead of a single collapsed finding. Confirm non-module findings keep their previous fingerprints. See TestInspect_TwoCallersGetDistinctCallChains and TestGetDatadogFingerprintHash_ModuleCallChain.

Blast Radius

This only affects findings for resources instantiated from local Terraform modules: their document identity and fingerprint now include the call chain. Root resources and all non-module findings are unchanged (empty chain reproduces the previous hash).

Additional Notes

Builds on #193; the call chain is used only for fingerprinting for now and is also carried on the finding so it can be surfaced to users in a follow-up.

I submit this contribution under the Apache-2.0 license.