Phase 2: Expand reusedCode detection to federal npm and PyPI dependencies

[haseebmalik18]

Summary

Auto-fills code.json's reusedCode field with the federal dependencies detected in a repository's manifests. Phase 2 of #124.

Changes

• Federal npm + PyPI package → agency mapping in src/gov-dependencies.data.ts. Every entry maps a package to the federal repo it comes from.
• Detects npm deps from package.json and PyPI deps from requirements.txt, each through its own lookup since PyPI normalizes names differently.
• Exact package names map 1:1 to their own entry with the repository URL.
• Refactor: agency constants and maps moved to src/gov-dependencies.data.ts. src/gov-dependencies.ts keeps the lookup logic only.

Note

• The list was generated with the auto-discovery tooling (#136)

[haseebmalik18]

Not ready for review yet

[haseebmalik18]

@natalialuzuriaga Ready for review

[sachin-panayil]

this is a great start. i left some general comments but before approving, i want to see this actually work and populate the reusedCode field in a repo. can you use testing-repo or any test repo to use this branch and actually show the reusedCode being detected and added?

[haseebmalik18]

@sachin-panayil Here is the successful run in test-repo:
https://github.com/DSACMS/testing-repository/actions/runs/30384490568

And the generated code.json with populated reusedCode field:
DSACMS/testing-repository@d01420c

[decause-gov]

In the interest of completing this rotation before EoW, we're going to merge this and see what happens... that's what git is for ;)

[haseebmalik18]

Something that can be a follow up is crawling through gitlab repos aswell?

[natalialuzuriaga]

LGTM! Amazing job with phase 2