Non-project contents

[martindurant]

Some metadata files are not explicitly connected to a "project" concept, or at least not always. Examples include (please add):

• requirements.txt/environment.yaml
• catalog.yaml (intake and similar)
• makefile
• Dockerfile

[martindurant]

Here is a list of environment specs as analysed by dependabot: https://docs.github.com/en/code-security/dependabot/ecosystems-supported-by-dependabot/supported-ecosystems-and-repositories#supported-ecosystems-and-repositories

projspec has a surprising overlap with dependabot, which a the narrow focus on dependency versions, but nevertheless must scan many spec types.