feat(helm): nested .Values linkage, template→kind typing, image/env + hook/RBAC edges

[ilyabrykau-orca]

What problem does this solve?

The Helm extractor (#338) delivered the template call-graph — {{ define }} named templates (Function 35), {{ include }} calls (CALLS 37), chart deps (DEPENDS_ON 2), verified on a real helm-charts repo. The values/render dataflow was out of that scope and is still missing:

• .Values.* not linked to keys: 189 .Values.x.y accesses across 25 templates; only 36 CONFIGURES edges over 4 top-level keys; nested keys (image.tag, image.repository) do not exist as nodes (qualified_name CONTAINS 'values.tag' -> 0). The image value node has 0 edges. "Which templates consume image.tag?" and unused-value detection are impossible.
• Helm templates not resource-typed: feat(k8s): index Kubernetes manifests and Kustomize overlays as graph nodes #86 typing (kind/metadata.name -> Resource) works on plain manifests — that is why one indexed repo has 54 Resource nodes. But in Helm charts the kind: sits inside {{ }} templating, so daemonset.yaml/service.yaml/*-rbac.yaml fall through to generic Module/File (0 resource-kind nodes in helm-charts). The feat(k8s): index Kubernetes manifests and Kustomize overlays as graph nodes #86 code path does not reach templated manifests.
• No image/env injection nodes: $.Values.image.repository, container env/envFrom/secretKeyRef not modeled; no string exposed for cross-repo image->producer matching.
• Hooks/RBAC dropped: 61 helm.sh/hook annotations unmodeled; Role->RoleBinding->ServiceAccount subject/roleRef edges absent.

Proposed solution

Extend the Helm path in internal/cbm/extract_k8s.c (which already owns both #86 manifests and #338 Helm):

1. Parse .Values.a.b.c access chains into nested values-key nodes; emit template -[:CONFIGURES]-> valuesKey; reconcile against values.yaml keys.
2. Apply feat(k8s): index Kubernetes manifests and Kustomize overlays as graph nodes #86 resource-kind typing to templated manifests (read the literal kind: even when the file contains {{ }}), so a Helm Deployment template maps to the same Resource-kind concept as a plain manifest.
3. Emit image: as a node (registry/repo/tag) + container env edges; expose the repo string for cross-repo matching.
4. Emit a Hook node (phase/weight from helm.sh/hook) and RBAC Role/ClusterRole -[:GRANTS]-> RoleBinding -[:SUBJECT]-> ServiceAccount.

Public OSS test beds: prometheus-community/helm-charts, bitnami/charts (deep nested values, RBAC, hooks), grafana/helm-charts.

Alternatives considered

• Generic YAML / current feat: Helm/YAML semantic extraction — named templates, includes, chart dependencies #338 output: template call-graph only; no values dataflow, kind, or lifecycle.
• helm template then parse rendered output: requires executing Helm; out of scope for a static parser.

Confirmations

• I searched existing issues. Strictly extends merged feat(k8s): index Kubernetes manifests and Kustomize overlays as graph nodes #86 + feat: Helm/YAML semantic extraction — named templates, includes, chart dependencies #338 (does not duplicate or contradict them); complements the IaC topology asks in task: Architecture — workspaces, cross-repo, worktrees, benchmarks (6 issues) #398.

[DeusData]

Thanks — the nested .Values linkage is the genuinely hard (and valuable) part here; queued for triage.