feat(ci): monitor vendored tree-sitter grammars for upstream updates

[magyargergo]

What & why

Closes the update-tracking blind spot from vendoring tree-sitter grammars. The npm-dependency grammars (tree-sitter-c, -python, -rust, …) are tracked by Dependabot — a new upstream release shows up as a PR. The vendored grammars (gitnexus/vendor/tree-sitter-*) are off the dependency graph, so nothing tells us when their upstream moves. This gives them the same daily "you're behind upstream" visibility.

How

• .github/scripts/check-vendored-grammar-updates.py — per-grammar drift, by upstream source:
  • npm (swift, kotlin): vendored version vs npm registry latest.
  • GitHub (dart, proto): vendored snapshot vs upstream default branch — recorded commit (from _vendoredBy) when present, else byte-compare src/parser.c.
  • Stdlib-only; exit 1 on drift.
• .github/workflows/vendored-grammar-updates.yml — daily (+ workflow_dispatch + PR self-test). Opens/updates a tracking issue on drift, closes it when current. Mirrors tree-sitter-upgrade-readiness.yml (issue upsert, pinned action SHAs, least-privilege permissions, persist-credentials: false).

Verified against live upstreams

| Grammar            | Vendored        | Upstream latest | Status     |
| tree-sitter-swift  | 0.7.1           | 0.7.1           | ✅ current |
| tree-sitter-dart   | 80e23c07b644    | a9bdfa3db2fb    | 🔴 behind  |
| tree-sitter-proto  | vendored parser | d65a18ce7c22    | 🔴 behind  |

(So on day one it'll flag that dart and proto have genuinely drifted from upstream — a real signal that was previously invisible.)

Scope notes

• Companion to the existing tree-sitter 0.25 runtime-upgrade readiness tracker — a different concern (runtime ABI, not version drift). I left that script untouched; note its vendored-grammar detection keys on a stale file: pin (our grammars are materialized now), which is a separate cleanup.
• kotlin is already in the config and activates automatically once it's vendored (feat(install): toolchain-free tree-sitter via vendored prebuilds #2113).
• A drift signal is informational — refreshing a vendored snapshot is a deliberate step (refresh vendor/ + re-run the prebuild workflow), which the issue prompts.

🤖 Generated with Claude Code

[vercel]

@magyargergo is attempting to deploy a commit to the NexusCore Team on Vercel.

A member of the Team first needs to authorize it.

[magyargergo]

Closing — opened in error. The native-binding hardening (periodic rebuilds of the prebuilds) is being handled in #2113; this standalone drift-monitor was a misread of that work and shouldn't be a separate PR. Deleting the branch.

[github-actions]

CI Report

❌ Some checks failed

Pipeline Status

Stage	Status	Details
✅ Typecheck	success	tsc --noEmit
❌ Tests	failure	unit tests, 3 platforms
✅ E2E	success	gitnexus-web changes only

Test Results

Tests	Passed	Failed	Skipped	Duration
10515	10498	1	16	557s

❌ 1 failed / 10498 passed

16 test(s) skipped — expand for details

• COBOL pipeline benchmark > scales with file count
• C++ ADL emit benchmark > emit phase scales sub-quadratically with co-scaled files and sites
• C++ pipeline benchmark > scales with file count
• C# pipeline benchmark > scales with file count — namespaces spread across the solution
• C# pipeline benchmark > scales with file count — all types in one (global) namespace bucket
• C# pipeline benchmark > scales with file count — all types in one (named) namespace bucket
• Go pipeline benchmark > scales with file count (workers enabled)
• Go pipeline benchmark — worker pool (issue Worker idle timeout kills long Go scope extraction and surfaces as Napi::Error during analyze #1848) > does not quarantine the large generated Go file on sub-batch idle timeout
• Go structural interface detection benchmark > scales linearly with interface × struct count
• Go structural interface detection split-phase benchmark > separates index-build and detection time
• PHP pipeline benchmark > scales with file count (workers enabled)
• Ruby pipeline benchmark > scales with file count (workers enabled)
• Rust pipeline benchmark > scales with file count (workers enabled)
• Vue pipeline benchmark > scales with component count
• run.cjs direct-exec entrypoint (fix(cli): steer docs, skills, and hooks through a CLI-neutral project-local runner (#1939) #1945) > resolves a .cmd shim via the Windows shell branch, passing args and exit code
• buildTypeEnv > known limitations (documented skip tests) > Ruby block parameter: users.each { |user| } — closure param inference, different feature

Code Coverage

Tests

Metric	Coverage	Covered	Base	Delta	Status
Statements	75.07%	35444/47214	N/A%	—	🟢 ███████████████░░░░░
Branches	62.81%	21902/34867	N/A%	—	🟢 ████████████░░░░░░░░
Functions	80.81%	3829/4738	N/A%	—	🟢 ████████████████░░░░
Lines	78.87%	32048/40632	N/A%	—	🟢 ███████████████░░░░░

---

_{📋 View full run · Generated by CI}