fix(scan): GOAT/Crescendo generators crash on empty languages list (#2602)

Both GOATAttackScenarioGenerator._select_objectives and
CrescendoAttackScenarioGenerator._select_objectives pick a random
language via `languages[int(rng.integers(len(languages)))]` with no
guard for an empty `languages` list. vulnerability_scan() accepts
languages: list[str] with no validation, so an empty list raises
`ValueError: high <= 0` from numpy instead of producing scenarios.

The sibling KnowledgeBaseScenarioGenerator._sample_languages already
handles this exact case correctly: `if not languages: return ["en"] *
scenario_count`. GOAT/Crescendo look like copy-pasted siblings (same
objectives-dict structure, same _select_objectives body) that never
received this guard.

Fix: `languages = languages or ["en"]` in both generators, mirroring
the existing correct fallback.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: chuenchen309

libs/giskard-scan/src/giskard/scan/generators/crescendo.py

@@ -88,6 +88,7 @@ def _select_objectives(
         assignments = list(DEFAULT_CRESCENDO_OBJECTIVES.items())
         selected_assignments: list[tuple[str, str]]
         rng = rng or np.random.default_rng()
+        languages = languages or ["en"]
 
         if max_scenarios is None or max_scenarios >= len(assignments):
             selected_assignments = assignments

libs/giskard-scan/src/giskard/scan/generators/goat.py

@@ -177,6 +177,7 @@ def _select_objectives(
         assignments = list(DEFAULT_GOAT_OBJECTIVES.items())
         selected_assignments: list[tuple[str, str]]
         rng = rng or np.random.default_rng()
+        languages = languages or ["en"]
 
         if max_scenarios is None or max_scenarios >= len(assignments):
             selected_assignments = assignments

libs/giskard-scan/tests/generators/test_crescendo.py

@@ -93,3 +93,16 @@ async def test_crescendo_multiturn_still_returns_scenarios():
         target_mode="multiturn",
     )
     assert len(scenarios) == len(DEFAULT_CRESCENDO_OBJECTIVES)
+
+
+async def test_crescendo_generator_falls_back_to_english_with_empty_languages():
+    """An empty `languages` list should fall back to English, mirroring
+    KnowledgeBaseScenarioGenerator._sample_languages, instead of crashing in
+    `rng.integers(0)`."""
+    gen = CrescendoAttackScenarioGenerator()
+    scenarios = await gen.generate_scenario(
+        ScenarioContext(description="A safety chatbot", languages=[])
+    )
+
+    assert len(scenarios) == len(DEFAULT_CRESCENDO_OBJECTIVES)
+    assert all(scenario.annotations["language"] == "en" for scenario in scenarios)

libs/giskard-scan/tests/generators/test_goat.py

@@ -92,3 +92,16 @@ async def test_goat_multiturn_still_returns_scenarios():
         target_mode="multiturn",
     )
     assert len(scenarios) == len(DEFAULT_GOAT_OBJECTIVES)
+
+
+async def test_goat_generator_falls_back_to_english_with_empty_languages():
+    """An empty `languages` list should fall back to English, mirroring
+    KnowledgeBaseScenarioGenerator._sample_languages, instead of crashing in
+    `rng.integers(0)`."""
+    gen = GOATAttackScenarioGenerator()
+    scenarios = await gen.generate_scenario(
+        ScenarioContext(description="A safety chatbot", languages=[])
+    )
+
+    assert len(scenarios) == len(DEFAULT_GOAT_OBJECTIVES)
+    assert all(scenario.annotations["language"] == "en" for scenario in scenarios)