Phase 2: Expand reusedCode detection to federal npm and PyPI dependencies

[haseebmalik18]

Summary

Auto-fills code.json's reusedCode field with the federal dependencies detected in a repository's manifests. Phase 2 of #124.

Changes

• Curated federal npm + PyPI package → agency mapping in src/gov-dependencies.data.ts.
• Detects npm deps from package.json and PyPI deps from requirements.txt, each through its own lookup since PyPI normalizes names differently.
• Exact package names map 1:1 to their own entry with the repository URL. Unlisted packages under a known org fall back to a scope-level entry so they still get picked up.
• Refactor: agency constants and maps moved to src/gov-dependencies.data.ts. src/gov-dependencies.ts keeps the lookup logic only.

[haseebmalik18]

Not ready for review yet

[haseebmalik18]

@natalialuzuriaga Ready for review

[sachin-panayil]

this is a great start. i left some general comments but before approving, i want to see this actually work and populate the reusedCode field in a repo. can you use testing-repo or any test repo to use this branch and actually show the reusedCode being detected and added?

[sachin-panayil]

how was the file created? if it was manually created, i think there needs to be some documentation within the file with who made it, and an explainer and the date it was created so then if it needs to be updated in the future, we can follow a lineage. there is also a bigger question of what do we need to do if we need to regenerate/update this file but i think we can get away with it since its government repos

[haseebmalik18]

This file was manually created, I am currently in talks with Natalia on the best way to automatically updating the list with new fed gov packages.

[haseebmalik18]

#136 is the follow up PR that automates the list by crawling through Fed Gov Github orgs

[haseebmalik18]

@sachin-panayil Here is the successful run in test-repo:
https://github.com/DSACMS/testing-repository/actions/runs/30384490568

And the generated code.json with populated reusedCode field:
DSACMS/testing-repository@d01420c