Add source declarations for more manifests

[andrew]

Adds source declarations for package.json, Python requirements and pyproject.toml, and GitHub Actions workflows. Repeated declarations are disambiguated, npm aliases retain their target package, and generated PURLs use canonical normalization.

[Copilot]

Pull request overview

This PR expands the manifest parsing surface to emit stable Declarations (source-level dependency references with logical Locations) for additional formats, and updates documentation/tests accordingly.

Changes:

• Add Declarations support to the npm package.json, PyPI requirements/pyproject.toml, and GitHub Actions workflow parsers.
• Add/expand unit tests validating declaration locations and versionless PURL generation/canonicalization.
• Update github.com/git-pkgs/purl dependency to v0.1.17 and document the newly supported declaration sources.

Reviewed changes

Copilot reviewed 9 out of 10 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
README.md	Documents that declarations are now available for npm, PyPI, GitHub Actions, and Maven.
manifests_test.go	Adds cross-ecosystem tests ensuring declaration PURLs are versionless and canonicalized.
internal/pypi/pypi.go	Adds declarations + location disambiguation for requirements.txt and pyproject.toml parsing.
internal/pypi/pypi_test.go	Adds tests validating PyPI declaration locations, version handling, and scope.
internal/npm/npm.go	Refactors dependency parsing into a helper that also records declarations with locations.
internal/npm/npm_test.go	Adds tests validating package.json declaration locations, alias handling, and scopes.
internal/github_actions/github_actions.go	Adds declarations for uses: steps with disambiguated locations per job.
internal/github_actions/github_actions_test.go	Adds tests validating workflow declaration locations and repetition suffixes.
go.sum	Updates checksums for the purl dependency bump.
go.mod	Bumps github.com/git-pkgs/purl to v0.1.17.

Suppressed comments (2)

internal/pypi/pypi.go:324

• Same non-deterministic location disambiguation issue as above: this loop iterates over a Go map and appends declarations whose Location uses a counter-based suffix when the normalized identity repeats. With colliding normalized names, base vs "/2" assignment can vary between runs.

Iterate in a deterministic order (collect keys and sort) before calling appendPyPIDeclaration().

		version := extractPoetryVersion(value)
		deps = append(deps, core.Dependency{
			Name:    name,
			Version: version,
			Scope:   core.Development,
			Direct:  true,
		})
		appendPyPIDeclaration(&declarations, locations, "tool/poetry/dev-dependencies", name, version, core.Development)
	}

internal/pypi/pypi.go:348

• Same non-deterministic location disambiguation issue: group.Dependencies is a Go map, but appendPyPIDeclaration() assigns numeric suffixes based on iteration order. If multiple dependency keys within a group normalize to the same identity, the resulting Location values can change between runs.

Iterate group.Dependencies keys in a deterministic order before appending declarations.

		for name, value := range group.Dependencies {
			version := extractPoetryVersion(value)
			deps = append(deps, core.Dependency{
				Name:    name,
				Version: version,
				Scope:   scope,
				Direct:  true,
			})
			location := "tool/poetry/group/" + url.PathEscape(groupName) + "/dependencies"
			appendPyPIDeclaration(&declarations, locations, location, name, version, scope)
		}

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.