ci: do not narrow the matrix when grammar submodules are missing

CI caught the exact under-selection this design exists to prevent. The
reference graph is read out of the upstream grammars, so with submodules
uninitialised the edges simply are not there:

  assert {'c', 'cpp'} >= {'c', 'cpp', 'solidity'}

tree-sitter-solidity is what records that solidity reads tree-sitter-c, so
without it checked out a tree-sitter-c bump would silently skip solidity.

- languages-for-paths now refuses to narrow when any tree-sitter-* dir has no
  content, and says which one. Dotfiles do not count as content: a deinitialised
  submodule can retain a .git file and would otherwise look populated.
- The enumerate job checks the grammars out so narrowing actually applies. Done
  by hand rather than via checkout's submodules: input, because gosu and
  requirements use SSH URLs that need the HTTPS rewrite first.
- Tests now assert both modes: the graph edges when submodules are present, and
  the fall-back-to-everything behaviour when they are not.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: malaverdiere

.github/workflows/test-languages.yml

@@ -34,6 +34,15 @@ jobs:
           # and `event_name == 'pull_request' && 0 || 1` would silently be 1 --
           # 0 is falsy in a GitHub Actions expression.
           fetch-depth: 0
+      # The reference graph lives inside the upstream grammars, so without them
+      # languages-for-paths cannot narrow and falls back to the full matrix.
+      # Done by hand rather than via checkout's submodules: input because the
+      # gosu and requirements submodules use SSH URLs, unusable in keyless CI.
+      - name: Check out grammars (for the reference graph)
+        run: |
+          set -euo pipefail
+          git config --global url."https://github.com/".insteadOf "git@github.com:"
+          git submodule update --init --depth 1 --jobs 8
       - id: list
         env:
           BASE_SHA: ${{ github.event.pull_request.base.sha }}

lang/scripts/languages-for-paths

@@ -80,6 +80,21 @@ def all_languages(src: Path) -> set[str]:
     return {p.name.removeprefix("semgrep-") for p in src.glob("semgrep-*") if p.is_dir()}
 
 
+def unpopulated_grammar_dirs(src: Path) -> list[str]:
+    """Upstream dirs with no checked-out content (submodule not initialised).
+
+    Edges live inside the upstream grammars, so an uninitialised submodule makes
+    the graph silently incomplete: without tree-sitter-solidity checked out,
+    nothing records that it reads tree-sitter-c, and a tree-sitter-c bump would
+    not test solidity. Callers must treat this as "cannot narrow".
+    """
+    def has_content(d: Path) -> bool:
+        # Dotfiles only (a stray .git) does not count: nothing to read edges from.
+        return any(p.name[0] != "." for p in d.iterdir())
+
+    return sorted(d.name for d in src.glob("tree-sitter-*") if d.is_dir() and not has_content(d))
+
+
 def main() -> int:
     """Print each language needing a test run on its own line."""
     argparse.ArgumentParser(
@@ -91,10 +106,19 @@ def main() -> int:
     paths = [line.strip() for line in sys.stdin if line.strip()]
     changed_dirs = {d for p in paths if (d := grammar_dir_of(p))}
     outside = [p for p in paths if grammar_dir_of(p) is None]
+    unpopulated = unpopulated_grammar_dirs(src)
+
+    if not paths:
+        why = "no changed paths given"
+    elif outside:
+        why = f"shared path {outside[0]!r}"
+    elif unpopulated:
+        why = f"{len(unpopulated)} uninitialised submodule(s), e.g. {unpopulated[0]}"
+    else:
+        why = None
 
-    if outside or not paths:
-        why = "no changed paths given" if not paths else f"shared path {outside[0]!r}"
-        print(f"languages-for-paths: testing everything ({why})", file=sys.stderr)
+    if why:
+        print(f"languages-for-paths: selecting everything ({why})", file=sys.stderr)
         languages = all_languages(src)
     else:
         languages = affected_languages(changed_dirs, src) & all_languages(src)

lang/test_languages_for_paths.py

@@ -5,10 +5,25 @@
 import subprocess
 from pathlib import Path
 
+import pytest
+
 LANG_DIR = Path(__file__).resolve().parent
 SCRIPT = LANG_DIR / "scripts" / "languages-for-paths"
 SRC = "lang/semgrep-grammars/src"
 
+# The reference graph is read out of the upstream grammars, so narrowing only
+# works when the submodules are checked out. Without them the script must fall
+# back to the full matrix -- asserted by test_uninitialised_submodules_* below.
+GRAMMARS = LANG_DIR / "semgrep-grammars" / "src"
+SUBMODULES_PRESENT = not [
+    d
+    for d in GRAMMARS.glob("tree-sitter-*")
+    if d.is_dir() and not any(p.name[0] != "." for p in d.iterdir())
+]
+needs_submodules = pytest.mark.skipif(
+    not SUBMODULES_PRESENT, reason="grammar submodules not initialised"
+)
+
 
 def run(*paths: str) -> list[str]:
     proc = subprocess.run(
@@ -23,21 +38,34 @@ def all_languages() -> list[str]:
     ).stdout.split()
 
 
+@needs_submodules
 def test_language_own_dir_narrows_to_that_language():
     assert run(f"{SRC}/semgrep-lua/grammar.js") == ["lua"]
 
 
+@needs_submodules
 def test_follows_references_between_grammars():
     """tree-sitter-c is read by cpp and solidity, not just c."""
     assert set(run(f"{SRC}/tree-sitter-c/src/parser.c")) >= {"c", "cpp", "solidity"}
     assert set(run(f"{SRC}/tree-sitter-c-sharp/grammar.js")) >= {"c-sharp", "c-sharp-pro"}
 
 
+@needs_submodules
 def test_upstream_dir_without_a_language_of_its_own():
     """tree-sitter-xml has no semgrep-xml; it is only reachable via html."""
     assert run(f"{SRC}/tree-sitter-xml/grammar.js") == ["html"]
 
 
+@pytest.mark.skipif(SUBMODULES_PRESENT, reason="submodules are initialised here")
+def test_uninitialised_submodules_select_everything():
+    """Without the upstream grammars the graph is incomplete, so do not narrow.
+
+    This is the dangerous case: tree-sitter-solidity records that it reads
+    tree-sitter-c, so with it absent a tree-sitter-c bump would skip solidity.
+    """
+    assert run(f"{SRC}/tree-sitter-c/src/parser.c") == all_languages()
+
+
 def test_shared_path_tests_everything():
     """Anything outside the grammar dirs can affect every language."""
     for shared in ["core/src/x.ml", "lang/Makefile", "lang/scripts/list-languages", ".github/x.yml"]: