Scanning: Python (PyPI) support via requirements.txt, poetry.lock, uv.lock

[rupertgermann]

Parent

#6

What to build

Add Python coverage to repository scanning: requirements.txt (pinned name==version entries), poetry.lock, and uv.lock are parsed into PyPI-ecosystem dependencies and checked against OSV like existing ecosystems. Follow existing precedence rules: lockfiles preferred, manifest/requirements declarations used with the existing version-normalization behavior otherwise (unpinned ranges that cannot resolve to an exact version are skipped, consistent with current behavior). Discovery reuses the existing subdirectory tree-walk. The supported-ecosystems registry gains the new file types so the repos UI reflects them automatically.

Acceptance criteria

• A requirements.txt fixture with pinned versions yields the expected PyPI dependency tuples; comments, blank lines, extras, and environment markers do not break parsing; unpinned entries are skipped
• poetry.lock and uv.lock fixtures yield lockfile-accurate PyPI dependency tuples
• When a lockfile and requirements.txt coexist, lockfile versions win
• Python dependency files in subdirectories are discovered in monorepos
• The supported-ecosystems list in the repos UI includes the Python file types
• A scan of a repo with a known-vulnerable pinned Python dependency surfaces OSV findings end-to-end
• TDD: parser behavior covered at the dependency-parser seam with fixture files; scan path covered with globalThis.fetch swapped; npm test green

Blocked by

None - can start immediately