fix(yaml): stop retrying an unrecoverable decode error in condition - #10238

The yamlpath engine retries a decode error it cannot recover from, so a single
unparseable file makes Condition allocate until the process is OOM-killed.

yaml.v3 does not advance past a syntax error: once Decode fails, every
subsequent call returns the same non-EOF error. The loop appends an error and
continues, so it spins forever:

if derr := dec.Decode(&doc); derr != nil {
    if derr == io.EOF { break }
    errorMessages = append(errorMessages, fmt.Errorf(
        "%q - parsing yaml file: %w", originalFilePath, err))
    continue
}

A heap profile of an org-wide GitHub Action autodiscovery run (45 repositories
via a githubsearch scm) shows where it goes:

Showing nodes accounting for 14.62GB, 99.35% of 14.71GB total
      flat  flat%   sum%        cum   cum%
   11.16GB 75.83% 75.83%    11.22GB 76.29%  fmt.errorf
    2.49GB 16.93% 92.76%    14.69GB 99.81%  ...resources/yaml.(*Yaml).Condition

    1.80GB    12.67GB    111:  errorMessages = append(errorMessages, fmt.Errorf(

The trigger in our case was a Markdown file sitting in a .github/workflows
directory. Its first document parses as a scalar; the remainder then yields a
sticky yaml: line 8: did not find expected <document start>. Any file that
parses partially will do it.

This stops reading the file on such an error, which is what source.go and
target_yamlpath.go already do for the same case — condition.go was the only
one retrying. It also wraps derr rather than err, which is nil at that
point, so the message reported %!w(<nil>) instead of the parse failure.

Test

cd pkg/plugins/resources/yaml
go test

Test_Condition_yamlpathUndecodableFile fails (10s guard, "the decoder loop is
spinning on a non-EOF error") with continue restored, and passes with break.

Verified against the real workload that surfaced it — same policy set, same 45
repositories: 15.4 GB peak, dying after 13 repositories → 886 MB peak across
547 pipelines.

Additional Information

Checklist

• I have updated the documentation via pull request in website repository.
• I have tested this pull request manually with a custom Updatecli build and it works as expected.

Tradeoff

Stopping at the first undecodable document means later documents in that file
are not inspected. They are unreachable anyway: the decoder cannot get past the
syntax error, so the previous behaviour never reached them either — it just
spun. The condition still reports the file as failing.

Potential improvement

derr == io.EOF could be errors.Is(derr, io.EOF) here and in the two sibling
files. Left alone to keep this diff to the bug.