[dekobon]

Summary

The Python example gates (test_book_examples.py, the CLI-parity rows in test_smoke.py / test_sarif.py, and the jupyter_quickstart.ipynb nbconvert job) were already in CI, but three things let them not run, or run against the wrong inputs. This closes those gaps without adding dependencies, action pins, or a second example inventory.

Changes

.github/workflows/ci.yml

1. Path filter covers the code the examples depend on. The py filter listed only big-code-analysis-py/** and the root manifests. The bindings crate path-depends on the root crate, the parse layer and the five vendored grammars, and cli_parity.py / test_smoke.py byte-compare against the bca CLI — so a change to any of those left every python-* job skipped. Added src/**, big-code-analysis-ast/**, big-code-analysis-cli/** and tree-sitter-{ccomment,mozcpp,mozjs,preproc,tcl}/**. Docs/book/web-only PRs still skip; the ci aggregator's skipped tolerance is unchanged.
2. Explicit, --locked CLI build for the parity examples. The bca_binary fixture built bca inside pytest without --locked. python-test now builds it in its own step and exports BCA_BINARY via $GITHUB_ENV (so it reaches the PowerShell pytest step on Windows, .exe suffix included). The fixture pytest.fails on a bad path, so this cannot degrade into a silent skip.
3. BCA_NOTEBOOK_FIXTURES set on the nbconvert step. The notebook documents it as the contract CI uses; CI never set it.

big-code-analysis-py/tests/test_book_examples.py

4. test_every_example_is_covered now reconciles *.ipynb against NON_PY_EXAMPLES, so a second notebook cannot land with nothing executing it. Single inventory kept.

Cost

Item 1 means python-lint, the 6-leg python-test matrix and python-examples-nbconvert now run on most code PRs rather than only bindings PRs. That is the intended trade — the alternative is parity tests that skip exactly when the CLI output changes. Item 2 adds no compile work: the fixture already ran the same cargo build on every leg; it is now visible and locked.

Validation

Check	Result
make actionlint	pass
cargo build -p big-code-analysis-cli --locked	ok
venv from requirements/dev.txt --require-hashes + maturin develop + BCA_BINARY=… pytest tests/test_book_examples.py tests/test_smoke.py -v	77 passed, 0 skipped; all 4 test_cli_parity* pass
same with BCA_BINARY=/nonexistent/bca	4 ERRORs — fixture fails loudly
stray examples/zz_unclaimed.ipynb	exactly test_every_example_is_covered fails
venv from requirements/examples.txt --require-hashes + exact nbconvert command with BCA_NOTEBOOK_FIXTURES	exit 0, 6/6 code cells executed
same with a wrong fixtures path	exit 1 via the notebook's own hello.rs assertion
make py-fmt-check py-lint py-typecheck	clean
make pre-commit	BCA_GATE: pass (gate=pre-commit)

Windows/macOS legs were not exercised locally; this PR's own matrix run is the test for the $GITHUB_ENV → pwsh handoff.

Out of scope

• Hardening the notebook against a markdown-only rewrite (nbconvert passes on a notebook with no code cells). The current notebook is not vacuous — its first cell asserts hello.rs exists — but a positive-output check would be a separate change.
• Reusing the test job's bca artifact in python-test instead of recompiling. Would save a cold-cache compile per leg but couples two jobs and changes the feature set the parity binary is built with.