feat(graph): C/C++ file detection and tree-sitter parsing foundation

[shivasurya]

Summary

Foundation for C/C++ language support — file discovery and tree-sitter
grammar selection only. No AST → Node dispatch yet, so Java/Python/Go
behavior is unchanged.

• Route .c, .cpp, .cc, .cxx, .h, .hpp, .hh, .hxx files to
  the C and C++ tree-sitter grammars
• Exclude common C/C++ build artifact directories from getFiles():
  build/, cmake-build-*, third_party/, external/, obj/, bin/,
  dist/, .cache/
• Disambiguate .h headers as C vs C++ via a best-effort heuristic
  (first ~100 lines scanned for class , namespace , template<,
  access specifiers, ::)
• Cache header classification in a sync.Map populated once per file in
  the initialize.go worker before AST traversal — keeps the per-node
  IsCSourceFile / IsCppSourceFile lookups zero-I/O

Package layout

C/C++ helpers live in a new graph/clike/ subpackage that sits alongside
the existing language siblings:

sast-engine/graph/
├── clike/         ← NEW: shared C/C++ helpers (detection now, parsers next)
│   ├── detection.go
│   └── detection_test.go
├── docker/
├── golang/
├── java/
└── python/

Subsequent PRs will add graph/clike/parser.go, type-string extraction,
and parameter extraction in the same package, mirroring the layout of
graph/golang/.

Test plan

• go build ./... — clean
• go vet ./... — clean
• golangci-lint run ./graph/... — 0 issues
• go test ./graph/... -count=1 — passes (no Java/Python/Go regressions)
• New unit tests in graph/clike/detection_test.go:
  • TestIsCSourceFile / TestIsCppSourceFile — every extension + cached/uncached .h
  • TestDetectCppInHeader — pure C, class, namespace, template, ::, extern "C", empty, missing-file
• Updated graph/utils_test.go::TestGetFilesIncludesCAndCpp — verifies inclusion of C/C++ extensions and exclusion of all build/artifact dirs

[safedep]

SafeDep Report Summary

No dependency changes detected. Nothing to scan.

View complete scan results →

_{This report is generated by SafeDep Github App}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[github-actions]

Code Pathfinder Security Scan

No security issues detected.

Metric	Value
Files Scanned	5
Rules	205

---

_{Powered by Code Pathfinder}

[codecov]

Codecov Report

❌ Patch coverage is 91.83673% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 85.07%. Comparing base (99ecf1e) to head (0f553a6).

Files with missing lines	Patch %	Lines
sast-engine/graph/initialize.go	60.00%	3 Missing and 1 partial ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #668   +/-   ##
=======================================
  Coverage   85.06%   85.07%           
=======================================
  Files         172      173    +1     
  Lines       25027    25070   +43     
=======================================
+ Hits        21290    21329   +39     
- Misses       2941     2944    +3     
- Partials      796      797    +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.