Anchor built-in directory exclude patterns to path-segment boundary

[navidkashani]

Problem

Several of the directory patterns in Config::BUILT_IN_EXCLUDE_PATTERNS are unanchored, so they behave as substring matches rather than path-segment matches. The most impactful case is /ext\//i:

var_dump(preg_match('/ext\//i', 'Text/Foo.php'));  // int(1) — wrong

Because "ext/" is a substring of "Text/" (case-insensitive), FileCopier::shouldExclude() returns true for every file under a Text/ directory, and the scoper silently drops it from the output. I hit this while vendoring a package that ships a Text/ source directory — the classes disappeared from vendor-prefixed/ with no warning.

The same class of bug exists for several sibling patterns.

Affected patterns

Pattern (before)	Example collision	Pattern (after)
/\.github\//i	rare (leading .)	`/(?:^
/\.gitlab\//i	rare (leading .)	`/(?:^
/examples?\//i	MyExamples/, bad-examples/	`/(?:^
/ext\//i	Text/, Context/ — real hit	`/(?:^
/php4\//i	graphql4/	`/(?:^
/tests?\//i	UnitTests/, apitest/	`/(?:^
/dev-bin\//i	my-dev-bin/	`/(?:^

Fix

(?:^|\/) is a non-capturing alternation that anchors the match to path-start or immediately after a /. This is the correct semantic for a "directory segment" match against the relative paths that FileCopier::shouldExclude(string $relativePath) receives.

The \b-anchored siblings (/\bbin\//i, /\bdocs?\//i) are intentionally left alone — \b has subtly different semantics at non-word characters (e.g. it still matches my-bin/), and changing them would be a behavior tweak outside this PR's scope. The loose filename patterns (CHANGELOG, Dockerfile, phpcs.xml, …) are also left alone because the substring matching is intentional there — it catches CHANGELOG.md, Dockerfile.dev, phpcs.xml.dist, etc.

Tests

• New tests/Unit/Config/BuiltInExcludePatternsTest.php with 28 data-provider rows covering each fixed pattern against canonical positives (e.g. ext/Foo.php, src/ext/Foo.php) and collision negatives (e.g. Text/Foo.php, Context/Foo.php, MyExamples/, graphql4/, UnitTests/, my-dev-bin/).
• Pattern strings are verified to exist in BUILT_IN_EXCLUDE_PATTERNS via reflection, then run directly through preg_match — no coupling to FileCopier.
• @dataProvider docblock + static provider method so the test runs cleanly on both PHPUnit 9.6 and 10.x.
• The two ext/ / examples?/ literal assertions in ConfigTest::testDefaultValues were updated to the new anchored strings.

Full Unit + Integration suites pass locally on PHP 8.5 / PHPUnit 10.5.

Back-compat note

This is a tightening of the pattern. Paths that used to match now do not — but the only paths affected are the substring collisions above (Text/, MyExamples/, UnitTests/, graphql4/, my-dev-bin/, …), which were being dropped unintentionally. There is no change in the generated output code for packages that don't contain such directories; for packages that do, the scoped output simply includes files that should have been included all along. No public API change.

Related

Surfaced downstream while integrating a package whose source lives in a Text/ directory into a WordPress plugin via wp-scoper.

Splitting

If you'd prefer a smaller first PR (e.g. ext/ only, since that's the one with a confirmed real-world hit), happy to rebase down to a single-pattern change — just say the word.