From: Aliaksei Budavei <0x000c70@gmail.com>
Date: Wed, 18 Feb 2026 18:35:26 +0000 (+0000)
Subject: runtime(syntax-tests): Fail when executable syntax tests are found
X-Git-Tag: v9.2.0019~1
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=dbd924f6a05427b153d35fa26c59258b09dcc902;p=thirdparty%2Fvim.git

runtime(syntax-tests): Fail when executable syntax tests are found

The input files with syntax test cases are never compiled or
interpreted on behalf of test runners, just read, and their
parts are rendered in accordance with syntax definitions for
associated languages, to be compared with previously vetted
renderings.  Whether their arbitrary contents will be valid
programs, benign programs, etc., is left for test authors to
decide and verify in their own environments.  As executable
and non-executable files equally qualify for testing and yet
executability is never exercised, and since maintaining
executable files turns out to be a short-lived exception
than common practice, let us persist in keeping syntax files
non-executable and enforce it with a CI check.

closes: #19433

Co-authored-by: Christian Brabandt <cb@256bit.org>
Signed-off-by: Aliaksei Budavei <0x000c70@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
---

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ca25f908e2..a8948eed9a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -47,7 +47,7 @@ jobs:
             extra: [nogui]
           - features: tiny
             compiler: gcc
-            extra: [nogui]
+            extra: [nogui, syn_test_execs]
           - features: tiny
             compiler: gcc
             extra: [nogui]
@@ -106,6 +106,13 @@ jobs:
           # exit with an error code and list the missing entries.
           make -C ci -f hlgroups.make
 
+      - name: Report executable syntax tests
+        if: contains(matrix.extra, 'syn_test_execs')
+        run: |
+          # Search and list all found executable syntax tests, and exit with
+          # an error code.
+          make -C runtime/syntax executables
+
       - run: sudo dpkg --add-architecture i386
         if: matrix.architecture == 'i386'
 
diff --git a/runtime/syntax/Makefile b/runtime/syntax/Makefile
index 9392b8dc98..d0f71270ac 100644
--- a/runtime/syntax/Makefile
+++ b/runtime/syntax/Makefile
@@ -27,7 +27,7 @@ RUN_VIMTEST = VIMRUNTIME=$(VIMRUNTIME) $(VALGRIND) $(ENVVARS) ../$(VIMPROG) -f $
 # DEBUGLOG = --log testlog
 
 # All initial phony targets; these names may clash with file types.
-phonies = clean test testclean
+phonies = clean executables test testclean
 .PHONY: $(phonies)
 
 # Run the tests that didn't run yet or failed previously.
@@ -53,6 +53,9 @@ testdir/testdeps.mk:
 
 -include testdir/testdeps.mk
 
+executables:
+	@! find testdir/input -type f -perm /a+x -exec echo Executable syntax test found: \{\} \; | grep :
+
 clean testclean:
 	rm -f testdir/failed/* testdir/done/* testdir/vimcmd testdir/messages testdir/Xtestscript testdir/Xfilter testdir/testdeps.mk
 
diff --git a/runtime/syntax/testdir/README.txt b/runtime/syntax/testdir/README.txt
index e4f3945c8f..bd3730435f 100644
--- a/runtime/syntax/testdir/README.txt
+++ b/runtime/syntax/testdir/README.txt
@@ -146,6 +146,9 @@ is covered by the test.  You can follow these steps:
 	- Vim setup file:   syntax/testdir/input/setup/{name}.vim (if any)
 	- test input file:  syntax/testdir/input/{name}.{ext}
 	- test dump files:  syntax/testdir/dumps/{name}_*.dump
+   Since no input file is ever executed when you run the tests, review and
+   revoke each previously granted permission to execute such a file before
+   publishing it; e.g. "chmod -x input/java.java; git add input/java.java".
 
 As an extra check you can temporarily put back the old syntax plugin and
 verify that the tests fail.  Then you know your changes are covered by the
diff --git a/runtime/syntax/testdir/input/sh_mksh_gibberish.ksh b/runtime/syntax/testdir/input/sh_mksh_gibberish.ksh
old mode 100755
new mode 100644