feat(k8s): add Kubernetes and Kustomize indexing support

[halindrome]

Closes #86

Summary

Adds first-class indexing support for Kubernetes manifests and Kustomize files, following the infra-pass pattern used by Dockerfile and docker-compose.

• Detection helpers (cbm_is_k8s_manifest, cbm_is_kustomize_file) — name-based for Kustomize, apiVersion: content heuristic for generic K8s manifests
• Custom extractor (extract_k8s.c) — parses manifests and kustomization files using the vendored YAML grammar; no new tree-sitter grammar needed
• Pipeline pass (pass_k8s.c) — emits Resource nodes for K8s manifests (Kind/metadata.name) and Module nodes for Kustomize files with IMPORTS edges to each entry in resources:
• CBMLanguage enum — CBM_LANG_K8S and CBM_LANG_KUSTOMIZE added; language table updated in lang_specs.c
• Tests — 6 new tests in tests/test_pipeline.c covering detection, extraction correctness, and null/empty-name guard
• README.md — Resource added to Node Labels list
• CONTRIBUTING.md — infra-pass pattern documented for future infrastructure language additions

What changed

File	Change
src/pipeline/pass_infrascan.c	cbm_is_k8s_manifest(), cbm_is_kustomize_file() helpers
internal/cbm/extract_k8s.c	New: custom YAML extractor for K8s and Kustomize
src/pipeline/pass_k8s.c	New: pipeline pass — node/edge emission
internal/cbm/cbm.h	CBM_LANG_K8S, CBM_LANG_KUSTOMIZE enum values
internal/cbm/lang_specs.c	Language table rows for K8s and Kustomize
tests/test_pipeline.c	6 new tests
README.md	Resource added to Node Labels list
CONTRIBUTING.md	Infra-pass pattern subsection

How to test

bash scripts/test.sh
bash scripts/lint.sh
make -f Makefile.cbm security

All three pass locally (2050 tests, clang-format clean, security 23/23).

Node labels

K8s manifests → Resource nodes (e.g. Deployment/my-app). Query: search_graph(label="Resource")

Kustomize files → Module nodes with IMPORTS edges to each referenced resource file.

[halindrome]

QA Round 1

Model used: Claude Opus 4.6

---

Findings

[Finding 1] MAJOR: Cached YAML result passed to handle_k8s_manifest produces zero Resource nodes

• What was tested: pass_k8s.c — when a YAML file has a cached extraction result and is identified as a K8s manifest via apiVersion check
• Expected vs actual: Expected Resource nodes to be emitted. Actual: cached CBMFileResult was extracted with CBM_LANG_YAML (not CBM_LANG_K8S), so cbm_extract_k8s() was never called. No defs with label "Resource" exist in the cache. Fallback re-extraction is skipped because res != NULL.
• Severity: major
• Confirmed vs hypothetical: Confirmed — CBM_LANG_K8S is never assigned during discovery (no EXT_TABLE or FILENAME_TABLE entry maps to it), so all K8s manifests arrive as CBM_LANG_YAML. The parallel pipeline path always produces a YAML-typed cached result with zero Resource definitions.

[Finding 2] MAJOR: Double file read for uncached K8s manifests

• What was tested: pass_k8s.c — uncached YAML files classified as K8s manifests
• Expected vs actual: Source is read for the cbm_is_k8s_manifest() check, then freed, then handle_k8s_manifest re-reads the same file. Every uncached K8s manifest is read from disk twice.
• Severity: major
• Confirmed vs hypothetical: Confirmed.

[Finding 3] MINOR: CONTRIBUTING.md states wrong extractor path

• What was tested: CONTRIBUTING.md documentation accuracy
• Expected vs actual: Doc says src/pipeline/extract_k8s.c (or extract_infra.c); actual file is internal/cbm/extract_k8s.c. Also describes them as "hand-written parsers that walk raw YAML/text" — they actually use tree-sitter YAML grammar (TSNode traversal).
• Severity: minor
• Confirmed vs hypothetical: Confirmed.

[Finding 4] MINOR: Case-sensitivity inconsistency in kustomization detection

• What was tested: language.c FILENAME_TABLE vs cbm_is_kustomize_file()
• Expected vs actual: language.c uses case-sensitive strcmp; cbm_is_kustomize_file uses to_lower+strcmp. A file named Kustomization.YAML is classified as CBM_LANG_YAML during discovery but detected as kustomize in pass_k8s.
• Severity: minor
• Confirmed vs hypothetical: Confirmed.

[Finding 5] MINOR: No test for multi-document YAML — only first document processed

• What was tested: extract_k8s.c — explicit break after first document; test_pipeline.c coverage
• Expected vs actual: Multi-document YAML (---) is common in K8s. The extractor only processes the first document. No test documents this as intentional; users silently lose resources after the first.
• Severity: minor
• Confirmed vs hypothetical: Confirmed.

[Finding 6] MINOR: strlen on full content in cbm_is_k8s_manifest

• What was tested: pass_infrascan.c — cbm_is_k8s_manifest implementation
• Expected vs actual: strlen scans the full buffer (up to 100MB) before copying only 4096 bytes. strnlen or a direct length bound would suffice.
• Severity: minor (performance only)
• Confirmed vs hypothetical: Confirmed.

[Finding 7] MINOR: Missing crds field in is_kustomize_list_key

• What was tested: extract_k8s.c — is_kustomize_list_key
• Expected vs actual: Handles resources, bases, patches, components, patchesStrategicMerge — but not crds, which is also a list of file paths in the Kustomize spec. CRD references won't produce IMPORTS edges.
• Severity: minor
• Confirmed vs hypothetical: Confirmed.

[Finding 8] NIT: Redundant block_node unwrap in extract_k8s_scalars

• What was tested: extract_k8s.c — second block_node check after earlier unwrap
• Expected vs actual: Dead code — val_node is already unwrapped from block_node before the second check.
• Severity: nit
• Confirmed vs hypothetical: Confirmed.

[Finding 9] NIT: get_scalar_text has unbounded recursion on flow_node chains

• What was tested: extract_k8s.c — recursive call for flow_node unwrapping
• Expected vs actual: Theoretical stack overflow on deeply nested flow_node chains. Tree-sitter YAML grammar never produces such nesting in practice.
• Severity: nit
• Confirmed vs hypothetical: Hypothetical.

[Finding 10] NIT: def.label = "Resource" is a string literal, not arena-allocated

• What was tested: extract_k8s.c — def.label assignment
• Expected vs actual: Other CBMDefinition fields are arena-allocated; label is a string literal. Safe with current arena-based freeing but inconsistent.
• Severity: nit
• Confirmed vs hypothetical: Confirmed inconsistency; currently safe.

---

SUMMARY: 0 critical, 2 major, 5 minor, 3 nit findings.

[halindrome]

QA Round 1 — Fixes Applied

Commit: f2678e7

[Major 1 + 2] Cached YAML result / double read — K8s manifests are discovered as CBM_LANG_YAML so their cached result has no Resource defs. Fix: always re-extract with CBM_LANG_K8S for files identified as K8s manifests, passing the already-loaded source buffer directly into the handler. Eliminates the cache misuse and the double file read in a single change. handle_k8s_manifest signature updated to accept (source, src_len).

[Minor 3] CONTRIBUTING.md path — Corrected to internal/cbm/extract_k8s.c; description updated to "tree-sitter-based parsers that walk the YAML AST".

[Minor 4] Case-sensitivity — Added a comment in language.c FILENAME_TABLE documenting the intentional behaviour: case-sensitive table entries; mixed-case variants fall through to CBM_LANG_YAML and are re-classified by cbm_is_kustomize_file() (case-insensitive) in pass_k8s.

[Minor 5] Multi-doc YAML test — Added k8s_extract_manifest_multidoc: a Deployment + Service separated by ---. Asserts no crash, first document's resource present, count >= 1. Comment documents the break-after-first-push semantics.

[Minor 6] strnlen — Replaced strlen(content) with strnlen(content, 4096) in cbm_is_k8s_manifest.

[Minor 7] crds field — Added "crds" to is_kustomize_list_key so CRD path lists produce IMPORTS edges.

[Nit 8] Dead block_node unwrap — Removed the unreachable second check in extract_k8s_scalars.

[Nit 10] Arena-allocated label — Changed def.label = "Resource" to def.label = cbm_arena_strdup(a, "Resource").

All 2051 tests pass.

[halindrome]

QA Round 2 — feat/k8s-kustomize

Model used: Claude Opus 4.6

---

Round 1 Fix Verification

All 8 fixes confirmed correctly applied.

---

New Findings

[Finding 1] MINOR: CONTRIBUTING.md references non-existent cbm_language.h

• What was tested: Whether cbm_language.h exists anywhere in the repo
• Expected vs actual: No such file. The CBMLanguage enum is in internal/cbm/cbm.h. A contributor following the guide would not find the referenced file.
• Severity: minor
• Confirmed vs hypothetical: Confirmed.

[Finding 2] NIT: CONTRIBUTING.md intro contradicts its tree-sitter statement

• What was tested: Internal consistency of the Infrastructure Languages section
• Expected vs actual: Line 89 says these languages "do not use tree-sitter grammars". Line 92 says the extractors are "tree-sitter-based parsers that walk the YAML AST". Line 98 says "do not add a tree-sitter grammar". The intent is "don't add a new grammar" but the opening sentence is misleading — K8s/Kustomize do use tree-sitter-yaml.
• Severity: nit
• Confirmed vs hypothetical: Confirmed.

[Finding 3] NIT: pass_k8s.c header says "per top-level resource document" (plural) but extractor only processes first document

• What was tested: Consistency between pass_k8s.c file header comment and extract_k8s.c behaviour
• Expected vs actual: pass_k8s.c header says "emit one Resource node per top-level resource document" implying all documents; extractor has an explicit break after the first. The test pins the single-document behaviour but the pass comment is misleading.
• Severity: nit
• Confirmed vs hypothetical: Confirmed.

[Finding 4] MINOR: handle_kustomize reads file from disk in fallback path — asymmetry with handle_k8s_manifest

• What was tested: pass_k8s.c — kustomize files are detected before source is read, so no source buffer is available to pass into handle_kustomize
• Expected vs actual: Functionally correct — handle_kustomize falls back to disk read when cached result is NULL. No bug. Noting the asymmetry for awareness.
• Severity: minor (informational, no correctness issue)
• Confirmed vs hypothetical: Confirmed.

---

SUMMARY: 0 critical, 2 minor (1 actionable, 1 informational), 2 nit findings. All Round 1 fixes verified correct.

[halindrome]

QA Round 2 — Fixes Applied

Commit: ca3a29e

[Minor 1] CONTRIBUTING.md cbm_language.h reference — corrected to internal/cbm/cbm.h, where the CBMLanguage enum actually lives.

[Nit 2] CONTRIBUTING.md tree-sitter contradiction — changed "do not use tree-sitter grammars" to "do not require a new tree-sitter grammar", with a note that they reuse the existing tree-sitter YAML grammar.

[Nit 3] pass_k8s.c header comment — updated to "emit one Resource node per file (first document only — multi-document YAML is not yet supported)".

All tests pass.

[halindrome]

QA Round 3 — Final Review

Model used: Claude Opus 4.6

---

Previous Fix Verification

#	Round	Finding	Status
1	R1-Major	Cached YAML result used for K8s manifests (missing Resource defs)	CONFIRMED — always re-extracts with CBM_LANG_K8S, cache discarded
2	R1-Major	Double file read in handle_k8s_manifest	CONFIRMED — source buffer passed from caller
3	R1-Minor	CONTRIBUTING.md wrong extractor path	CONFIRMED — internal/cbm/extract_k8s.c, tree-sitter noted
4	R1-Minor	Case-sensitivity inconsistency undocumented	CONFIRMED — explanatory comment added in language.c
5	R1-Minor	No multi-document YAML test	CONFIRMED — k8s_extract_manifest_multidoc added
6	R1-Minor	Unbounded strlen in cbm_is_k8s_manifest	CONFIRMED — strnlen(content, 4096)
7	R1-Minor	Missing "crds" in kustomize list keys	CONFIRMED — added
8	R1-Nit	Dead block_node unwrap in metadata descent	CONFIRMED — removed
9	R1-Nit	String literal for def.label	CONFIRMED — cbm_arena_strdup(a, "Resource")
10	R2-Minor	CONTRIBUTING.md referenced non-existent cbm_language.h	CONFIRMED — corrected to internal/cbm/cbm.h
11	R2-Nit	CONTRIBUTING.md "do not use tree-sitter grammars" (misleading)	CONFIRMED — "do not require a new tree-sitter grammar"
12	R2-Nit	pass_k8s.c header implied all documents processed	CONFIRMED — "first document only" now explicit

---

Code Analysis

All changed files reviewed. Code is well-structured, follows existing infra-pass patterns, and memory management is correct throughout. Highlights:

• extract_k8s.c — tree-sitter YAML traversal is correct; all arena allocations properly managed; no use-after-free or buffer overflow risks
• pass_k8s.c — re-extraction with CBM_LANG_K8S correctly ensures Resource defs are present; DEFINES/IMPORTS edge emission follows established graph_buffer patterns; all malloc/free pairs balanced
• pass_infrascan.c — both detection helpers have correct NULL guards and bounded content scans
• tests/test_pipeline.c — 6 new tests covering detection (including case-insensitive and NULL guards), extraction, graceful handling of missing metadata.name, and multi-document behaviour pinning

---

Remaining Issues

None.

---

Verdict

PASS — Ready to merge. All Round 1 and Round 2 fixes correctly applied. 2051 tests pass. Code is clean and follows project conventions.

[halindrome]

Testing against a real gitops repository

After opening this PR I tested the indexer against a live gitops monorepo (~10k files, git submodules, 213 kustomization.yml overlays). The testing revealed two issues, both now fixed in the latest commits on this branch.

Bug found: k8s pass missing from incremental pipeline

cbm_pipeline_pass_k8s() was called in pipeline.c (full index) but absent from pipeline_incremental.c. This meant k8s Resource nodes and kustomize Module nodes were created correctly on the first full index, but never updated during incremental re-indexing (which is what runs on every file-save or watcher event).

Fix: added the k8s pass to pipeline_incremental.c after the semantic pass, following the same timing-log pattern as the other incremental passes. Two regression tests added (incremental_k8s_manifest_indexed, incremental_kustomize_module_indexed).

Known structural limitation (documented in code comment): In the incremental path, File→Resource DEFINES edges and cross-file kustomize IMPORTS edges are not emitted. The incremental gbuf only contains nodes for changed files, and File nodes (from pass_structure, which does not run in incremental) are absent. This is consistent with how all other incremental passes behave.

Clarification: InfraFile nodes are shell scripts, not YAML manifests

During testing I noticed the gitops repo had 35 InfraFile nodes. These come from pass_infrascan.c and represent shell scripts that call kubectl/kustomize — not YAML manifests. This is correct and expected behaviour; I'm noting it here in case it causes confusion for others exploring the graph.

k8s YAML manifests get Resource nodes (from the k8s pass). Kustomize overlays get Module nodes. Shell scripts that orchestrate k8s get InfraFile nodes. These three labels represent distinct concerns.