From aa7f940ec6f88f8519696fb70b62156a76febde7 Mon Sep 17 00:00:00 2001
From: glorydavid03023 <glorydavid03023@gmail.com>
Date: Sat, 4 Jul 2026 03:54:15 +0900
Subject: [PATCH] fix(rees): classify bower_components and jspm_packages as
 vendored in provenance
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The provenance analyzer's VENDORED_PATH_RE recognized vendor/node_modules/third_party
but not bower_components (Bower) or jspm_packages (JSPM) — installed-dependency
directories that are the same vendored case as node_modules. #2777 added exactly
these to the server-side path classifier (src/signals/path-matchers.ts), but
review-enrichment ships as a standalone package with its own copy, so the fix did
not reach it. A committed bower/jspm tree therefore fell through to null (ordinary
source) instead of "vendored", so the provenance analyzer treated vendored
third-party code as reviewable contributor source.

Add both directories to VENDORED_PATH_RE (directory-segment anchored, so a source
file merely named like the dir is unaffected). Adds a provenance regression.
---
 review-enrichment/src/analyzers/provenance.ts |  6 +++--
 review-enrichment/test/provenance.test.ts     | 24 +++++++++++++++++++
 2 files changed, 28 insertions(+), 2 deletions(-)
 create mode 100644 review-enrichment/test/provenance.test.ts

diff --git a/review-enrichment/src/analyzers/provenance.ts b/review-enrichment/src/analyzers/provenance.ts
index eb74bda6c1..ace51c8edd 100644
--- a/review-enrichment/src/analyzers/provenance.ts
+++ b/review-enrichment/src/analyzers/provenance.ts
@@ -20,9 +20,11 @@ const MAX_FINDINGS = 30; // keep the brief bounded
 // Compiled/non-source binary artifact extensions.
 const BINARY_EXT_RE =
   /\.(exe|dll|so|dylib|bin|pyc|pyo|class|jar|war|ear|wasm|o|a)$/i;
-// Vendored / embedded third-party source trees.
+// Vendored / embedded third-party source trees. bower_components (Bower) and jspm_packages (JSPM) are
+// installed-dependency directories — the same vendored case as node_modules — so a committed tree under either
+// is a vendored artifact, not contributor source (mirrors src/signals/path-matchers.ts's vendored classifier).
 const VENDORED_PATH_RE =
-  /(?:^|\/)(?:vendor|node_modules|third[_-]party|vendors)\//;
+  /(?:^|\/)(?:vendor|vendors|node_modules|bower_components|jspm_packages|third[_-]party)\//;
 // Minified files carry no reviewable source in the diff (effectively vendored).
 const MINIFIED_RE = /\.min\.[cm]?[jt]s$|\.min\.css$/i;
 
diff --git a/review-enrichment/test/provenance.test.ts b/review-enrichment/test/provenance.test.ts
new file mode 100644
index 0000000000..9789e37f0f
--- /dev/null
+++ b/review-enrichment/test/provenance.test.ts
@@ -0,0 +1,24 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+import { classifyAddedFile } from "../dist/analyzers/provenance.js";
+
+test("classifyAddedFile treats bower_components and jspm_packages as vendored, like node_modules (#2777 parity)", () => {
+  // Installed-dependency directories are vendored artifacts, not contributor source. Before this, a committed
+  // bower/jspm tree fell through to null (ordinary source) while node_modules/vendor were already caught.
+  for (const path of [
+    "bower_components/jquery/dist/jquery.js",
+    "web/bower_components/angular/angular.js",
+    "jspm_packages/npm/lodash@4.17.21/lodash.js",
+    "frontend/jspm_packages/github/x.js",
+  ]) {
+    assert.equal(classifyAddedFile(path), "vendored", path);
+  }
+  // Existing vendored directories still classify (control).
+  for (const path of ["node_modules/x/index.js", "vendor/foo.rb", "third_party/lib.c", "third-party/lib.c", "vendors/a.js"]) {
+    assert.equal(classifyAddedFile(path), "vendored", path);
+  }
+  // Directory-segment anchored: a source file merely NAMED like the dir is not vendored; plain source is null.
+  assert.equal(classifyAddedFile("src/bower_components.ts"), null);
+  assert.equal(classifyAddedFile("src/app.ts"), null);
+});