Motivation

When --x-local-module-eval is enabled, the scanner instantiates Terraform module resources and emits synthetic OPA documents for them. The previous implementation had two correctness bugs identified when I re-reviewed:

1. Cross-root dedup used per-file content only. Two callers from different root stacks could be incorrectly merged if their shared resource file had identical content but sibling files differed (e.g. one caller's instance.tf references a security group; the other's does not). This caused one caller's findings to be silently dropped.

2. count/for_each instances collapsed to base name. When a resource expanded to multiple instances (e.g. replica[0], replica[1]), all instances were written into a single map under the bare label replica. Each subsequent instance silently overwrote the previous one, so only one finding was produced instead of one per instance.

Changes

Per-instance findings

Each expanded module resource instance (from count or for_each) is now scanned independently. A module that creates two bucket replicas with the same misconfiguration will report two findings instead of one.

Cross-file references inside a module

When a module splits resources across multiple .tf files, references between them are now visible to cross-resource rules. A security group defined in sg.tf and used by an instance in instance.tf is correctly treated as in use, so rules like "Security group not used" no longer fire false positives in that case.

Deduplication across callers

When the same module is called from multiple root stacks, callers are only treated as identical when the entire module call resolves to the same content, not just when one file matches. Two stacks that share an identical security group definition but differ elsewhere (e.g. one references the SG, the other does not) are no longer merged, so each stack keeps its own findings. Identical callers from different roots are still deduplicated as before.

QA Instruction

1. go test ./pkg/engine/... — all existing and new tests pass.
2. golangci-lint run ./pkg/engine/... — no issues.
3. Build: go build -o /tmp/iac-scanner ./cmd/scanner/
4. Scan a Terraform repository with local modules: ./iac-scanner scan --x-local-module-eval --type terraform --path <repo> and confirm no unexpected changes in finding counts for cross-resource rules like "Security group not used".

Impact

Affects only the --x-local-module-eval experimental code path. The baseline scan pipeline (flag off) is unchanged. Modules without count/for_each and without cross-file references are unaffected in behaviour; only the two buggy edge cases now produce correct results.