[8] Generalize GithubDependencyTreeTask to support multiple ecosystems

[abs51295]

Epic: #2326

User Story

As on OSIO user, I will be able to get vulnerabilities for all my direct and transitive dependencies so that I can refine my stack to remove the vulnerabilities.

Description

Currently GithubDependencyTreeTask identifies the direct and transitive dependencies for a given maven repository. Need to extend this to extract direct and transitive dependencies for node, python and go ecosystem.

Acceptance Criteria

• Given a repository, the task should be able to identify the ecosystem and return the list of all direct and transitive dependencies.

Task list

• Implement dependency parser for node ecosystem.
  • Identify the unique identifier that classifies the repository as a node repository.
  • Run mercator command and parse the output to get all the direct and transitive dependencies.
• Implement dependency parser for python ecosystem.
  • Identify the unique identifier that classifies the repository as a python repository.
  • Run mercator command and parse the output to get all the direct and transitive dependencies.
• Implement dependency parser for go ecosystem.
  • Identify the unique identifier that classifies the repository as a Go repository.
  • Run mercator command and parse the output to get all the direct and transitive dependencies.

Additional Task list

• Deploy worker-api with osioAnalysisFlow on production.
• Develop /scan endpoint to initiate osioAnalysisFlow.

[msrb]

One thing to keep in mind here is that if parsing dependencies requires executing code from users' setup.py files, or if npm list command requires the dependencies to be installed first (and thus executing untrusted scripts), then this cannot be done in our current worker containers. Untrusted code could attempt to damage our infrastructure or to steal credentials as those are available in worker containers in environment variables.

[abs51295]

This has to be moved to Sprint 147 since there were different priorities worked upon in 146. Thanks.
/cc @sivaavkd