[tdruez]

Issues

• Closes: code-genetics: Design and implement heuristics to combine origin matches #1929

Determine the origin of each matched file and directory by combining the origin matches of MatchCode.io and SCANOSS. Confirmed origins become packages, so they appear in the existing outputs.

How it works

The find_origins pipeline ends with a new determine_origins step:

1. Group the matches of each resource by package, including the equivalent PURLs reported by the tools (pkg:github/benjaminp/six and pkg:pypi/six).
2. A matched directory covers its files, and the deepest matched directory wins.
3. Apply the rules below to set an OriginDetermination per resource: auto-confirmed or needs-review.
4. Assign the resources of confirmed origins to their package, created with its license and URLs when missing.

Re-running the pipeline replaces the automatic determinations and keeps the decisions made by users.

Rules

Rule	When	Status
conflicting-candidates	Several different packages	needs-review
conflicting-versions	Several versions of the same package	needs-review
no-exact-match	Only partial matches	needs-review
single-tool	Exact match reported by one tool only	needs-review
confirmed-by-two-tools	One package, exact match, reported by both tools	auto-confirmed

Changes

• Add the OriginDetermination model: one per resource, with the origin PURL, status and rule.
• Add the determine_origins step to the find_origins pipeline.
• Add the origin pipe module with the determination rules.
• Assign the resources of confirmed origins to their package.
• Fix the list rendering of the FindOrigins docstring in the documentation.
• Add the changelog entry.