feat(graph/clike): shared C/C++ AST extraction helpers

[shivasurya]

Summary

Stacked on #668 (C/C++ file detection foundation).

Adds the cross-cutting primitives that the C parser (PR-03) and C++ parser
(PR-04) will share. Centralising the extraction logic here prevents two
parallel implementations from drifting apart, and matches the convention
used by graph/golang/, graph/python/, graph/java/, and graph/docker/.

Files

sast-engine/graph/clike/
├── doc.go                  ← package documentation
├── detection.go            ← (from PR-01) language detection
├── detection_test.go       ← (from PR-01)
├── declarations.go         ← FunctionInfo, FieldInfo, extractors
├── declarations_test.go
├── types.go                ← ExtractTypeString
├── types_test.go
├── helpers.go              ← params, calls, keyword maps
├── helpers_test.go
└── testhelpers_test.go     ← shared parseC/parseCpp/findNode test utilities

Helpers

• ExtractFunctionInfo → name, return type, params, IsDeclaration
  flag (forward decl vs definition)
• ExtractStructFields → name+type pairs for structs/classes
• ExtractTypeString → canonical type string with qualifiers,
  pointer/reference suffixes, templates, qualified names. Examples:
  char*, const std::string&, unsigned long long,
  std::vector<int>, int**
• ExtractParameters → parallel (names, types) slices, variadics
  rendered as ("...", "...")
• ExtractCallInfo → classifies calls as free / method-dot
  (obj.foo()) / method-arrow (ptr->foo()) / qualified
  (std::move(x)); captures receiver and args
• IsCKeyword / IsCppKeyword → C89..C23 + C++ additions; used by
  PR-05's statement extraction to filter reserved words

Why an innerDeclarator helper

Tree-sitter's C grammar exposes pointer_declarator → declarator (field),
but the C++ reference_declarator node only has anonymous named children
for & and the inner identifier. innerDeclarator tries the field-named
child first and falls back to scanning named children, so the same
declarator walker handles int**, char*, and const std::string&
without per-grammar branching.

Test plan

• go build ./... — clean
• go vet ./... — clean
• golangci-lint run ./graph/... — 0 issues
• go test ./graph/... -count=1 — all pass (no regressions)
• TestExtractTypeString — 11 cases (primitives, pointers, refs,
  qualifiers, templates, qualified names) + nil guard
• TestExtractFunctionInfo — C/C++ definitions, void/typed/pointer
  returns, variadics, namespaced methods + nil guard
• TestExtractStructFields — populated and empty structs + nil guard
• TestExtractParameters — typed, variadic, unnamed, void, C++
  const-ref + nil guard
• TestExtractCallInfo — free / dot / arrow / qualified shapes +
  nil and wrong-node guards
• TestIsCKeyword / TestIsCppKeyword — C89..C23 keywords, C++-only
  additions, non-keywords, and the C/C++ exclusivity boundary

[safedep]

SafeDep Report Summary

No dependency changes detected. Nothing to scan.

View complete scan results →

_{This report is generated by SafeDep Github App}

[github-actions]

Code Pathfinder Security Scan

No security issues detected.

Metric	Value
Files Scanned	9
Rules	205

---

_{Powered by Code Pathfinder}

[codecov]

Codecov Report

❌ Patch coverage is 92.94118% with 12 lines in your changes missing coverage. Please review.
✅ Project coverage is 85.11%. Comparing base (8af6b85) to head (96d2c4a).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
sast-engine/graph/clike/types.go	84.31%	4 Missing and 4 partials ⚠️
sast-engine/graph/clike/declarations.go	96.29%	2 Missing ⚠️
sast-engine/graph/clike/helpers.go	96.92%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #669      +/-   ##
==========================================
+ Coverage   85.06%   85.11%   +0.04%     
==========================================
  Files         173      176       +3     
  Lines       25070    25240     +170     
==========================================
+ Hits        21326    21482     +156     
- Misses       2947     2955       +8     
- Partials      797      803       +6     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[shivasurya]

• feat(python-sdk): @c_rule / @cpp_rule decorators with language scoping #678
• feat(cfg+scan+output): wire C/C++ pipeline end-to-end #677
• feat(extraction): C/C++ statement extraction #676
• feat(callgraph): C++ call graph builder #675
• feat(callgraph): C call graph builder #674
• feat(callgraph): C/C++ explicit type inference engines #673
• feat(callgraph): C/C++ module registry and include resolution #672
• feat(graph): C++ parser — classes, namespaces, templates, exception flow #671
• feat(graph): C parser — function defs, types, decls, calls, includes #670
• feat(graph/clike): shared C/C++ AST extraction helpers #669 👈 (View in Graphite)
• feat(graph): C/C++ file detection and tree-sitter parsing foundation #668
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[shivasurya]

Merge activity

• May 3, 1:15 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• May 3, 1:17 PM UTC: Graphite rebased this pull request as part of a merge.
• May 3, 1:18 PM UTC: @shivasurya merged this pull request with Graphite.