[Jah-yee]

Overview

Adds the missing PURL conversion for the GitHub Actions OSV ecosystem.

The checklist in #2402 still has GitHub Actions (github?) unticked, and no
PURL entry existed for it, so GitHub Actions advisories had no PURL
representation in the API output.

This change maps the ecosystem to the github PURL type, so a package such as
actions/checkout is rendered as pkg:github/actions/checkout and parses back
to the original actions/checkout name (with an optional version).

Refs #2402

Details

• osv/purl_helpers.py: add 'GitHub Actions': EcosystemPURL('github', None)
  to ECOSYSTEM_PURL_DATA, and allow the github PURL type to re-join the
  namespace and name when parsing (pkg:github/<owner>/<repo>).
• go/purl/ecosystems_simple.go: register the same mapping with
  registerSlash(osvconstants.EcosystemGitHubActions, "github"), which
  splits the owner/repo package name into the PURL namespace and name and
  joins them again when parsing.
• osv/purl_helpers_test.py and go/purl/purl_test.go: unit tests for
  package-to-PURL and PURL-to-package in both directions.

Both implementations are covered so the Python library
(osv/models.py uses purl_helpers.package_to_purl) and the Go worker
pipeline (go/internal/worker/pipeline/purl) stay consistent.

Testing

• python3 -m unittest osv.purl_helpers_test (3 tests, OK)
• go test ./purl/ in go/ (ok)
• gofmt applied to the modified Go files

Note

This contribution is AI-assisted: the change was drafted by an AI agent and
reviewed by the human submitter.

[G-Rath]

Please read our contributing guide before opening pull requests