feat(provider): add bun.lock support

[Strum355]

Summary

• Add a Javascript_bun provider that parses bun.lock directly using jsonc-parser, since bun does not implement bun pm ls --json (oven-sh/bun#26222)
• Expose base class _createLockFile so the bun provider can refresh the lock file via bun install --lockfile-only before parsing, matching the behavior of all other JS providers
• Register bun in workspace detection (detectWorkspaceManifests) and provider matching

Closes fabric8-analytics/fabric8-analytics-vscode-extension#887
Refs: TC-4412, TC-4409

Test plan

• All existing npm/pnpm/yarn tests pass (no regressions)
• New bun isSupported tests (with/without lock file, workspace members)
• New bun SBOM tests for stack and component analysis (3 dep scenarios + workspace member)
• New bun workspace member match/throw tests
• ESLint passes with no errors
• 439 passing, 14 failing (pre-existing gradle workspace failures)

🤖 Generated with Claude Code

Summary by Sourcery

Add a new Bun JavaScript provider that parses bun.lock files for dependency analysis and integrates it into workspace detection and provider matching.

New Features:

• Introduce a Javascript_bun provider that reads bun.lock files and builds dependency trees for stack and component analysis.
• Support Bun workspaces by resolving workspace members and their dependencies from bun.lock.

Enhancements:

• Expose the Base_javascript lockfile creation method for reuse by the Bun provider.
• Extend JavaScript workspace detection to treat bun.lock as a lockfile for manifest support checks.
• Register the Bun provider in the global provider list so it participates in automatic provider matching.

Build:

• Add jsonc-parser as a dependency for parsing bun.lock files.

Tests:

• Add Bun-specific isSupported scenarios covering presence/absence of bun.lock and workspace members.
• Add Bun SBOM fixture tests for stack and component analysis across multiple dependency configurations.
• Add Bun workspace resolution tests, including behavior with TRUSTIFY_DA_WORKSPACE_DIR and missing lockfiles.

[sourcery-ai]

Reviewer's Guide

Adds a new Javascript_bun provider that parses bun.lock directly using jsonc-parser, wires it into provider selection and workspace detection, exposes the JS base provider lockfile-creation hook for reuse, and adds bun-specific fixtures and tests for isSupported, SBOM generation, and workspace behavior.

File-Level Changes

Change	Details	Files
Introduce Javascript_bun provider that reads bun.lock and builds dependency trees/SBOMs from Bun workspaces	Create Javascript_bun class extending Base_javascript with Bun-specific command names, lockfile name, and install command arguments Implement _buildDependencyTree to refresh bun.lock, parse it with jsonc-parser, find the relevant workspace entry, and recursively resolve direct and transitive dependencies from lockData.packages Add Bun provider to availableProviders so it participates in provider matching	src/providers/javascript_bun.js src/provider.js package.json package-lock.json
Expose lockfile creation in the JS base provider so Bun can reuse it and still refresh lock files before dependency listing/parsing	Change Base_javascript.#createLockFile to a protected method _createLockFile and update call sites to use the new name Ensure _buildDependencyTree in Bun provider calls _createLockFile on the directory containing bun.lock before reading and parsing it	src/providers/base_javascript.js src/providers/javascript_bun.js
Include bun.lock in JS workspace detection so Bun projects are recognized as JS workspaces	Extend detectWorkspaceManifests to treat presence of bun.lock at the workspace root as an indicator of a JavaScript workspace, alongside pnpm-lock.yaml, yarn.lock, and package-lock.json	src/index.js
Add Bun-specific tests and fixtures for provider support, SBOM output, and workspace/lockfile behavior	Extend createMockProvider and isSupported test matrix to cover bun, including workspace member cases with and without bun.lock Add SBOM tests for Bun (stack and component analysis) across multiple dependency scenarios and a workspace member, using bun-specific tst_manifests and expected SBOM JSON files Add tests validating Bun workspace matching and lockfile lookup behavior, including TRUSTIFY_DA_WORKSPACE_DIR handling and error cases when bun.lock is missing Introduce Bun test manifests and bun.lock fixtures for simple, mixed-dependency, exhortignore, and workspace scenarios	test/providers/javascript.test.js test/providers/provider_manifests/bun/** test/providers/tst_manifests/bun/**

Assessment against linked issues

Issue	Objective	Addressed	Explanation
fabric8-analytics/fabric8-analytics-vscode-extension#887	Recognize bun.lock as a valid JavaScript lockfile so that Bun-based workspaces are detected and no longer trigger the "package.json requires a lock file" error.	✅
fabric8-analytics/fabric8-analytics-vscode-extension#887	Add a Bun provider that can refresh and parse bun.lock to build dependency trees/SBOMs for Bun projects, enabling normal analysis without requiring an npm/yarn/pnpm lockfile.	✅

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've left some high level feedback:

• In Javascript_bun._buildDependencyTree, the parse call on bun.lock assumes valid JSONC; consider handling parse errors or unexpected lockData shapes to avoid uncaught exceptions and to provide a clearer error when the lockfile is malformed or mismatched with the manifest.
• Within Javascript_bun._buildDependencyTree, you call this._getManifest() multiple times for manifestPath, name, and version; caching the manifest object in a local variable would simplify the code and avoid repeated method calls.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- In `Javascript_bun._buildDependencyTree`, the `parse` call on `bun.lock` assumes valid JSONC; consider handling parse errors or unexpected `lockData` shapes to avoid uncaught exceptions and to provide a clearer error when the lockfile is malformed or mismatched with the manifest.
- Within `Javascript_bun._buildDependencyTree`, you call `this._getManifest()` multiple times for `manifestPath`, `name`, and `version`; caching the manifest object in a local variable would simplify the code and avoid repeated method calls.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[ruromero]

only one minor comment from my side

[ruromero]

LGTM