internal/rosa: represent runtime dependencies

This also resolves indirect dependencies, reducing noise.

Signed-off-by: Ophestra <cat@gensokyo.uk>

internal/rosa/all.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"net/http"
 	"strconv"
 	"sync"
@@ -167,6 +168,36 @@ const (
 	PresetEnd
 )
 
+// P represents multiple [PArtifact] and is stable through JSON.
+type P []PArtifact
+
+// MarshalJSON represents [PArtifact] by their [Metadata.Name].
+func (s P) MarshalJSON() ([]byte, error) {
+	names := make([]string, len(s))
+	for i, p := range s {
+		names[i] = GetMetadata(p).Name
+	}
+	return json.Marshal(names)
+}
+
+// UnmarshalJSON resolves the value created by MarshalJSON back to [P].
+func (s *P) UnmarshalJSON(data []byte) error {
+	var names []string
+	if err := json.Unmarshal(data, &names); err != nil {
+		return err
+	}
+
+	*s = make(P, len(names))
+	for i, name := range names {
+		if p, ok := ResolveName(name); !ok {
+			return fmt.Errorf("unknown artifact %q", name)
+		} else {
+			(*s)[i] = p
+		}
+	}
+	return nil
+}
+
 // Metadata is stage-agnostic information of a [PArtifact] not directly
 // representable in the resulting [pkg.Artifact].
 type Metadata struct {
@@ -179,6 +210,9 @@ type Metadata struct {
 	// Project home page.
 	Website string `json:"website,omitempty"`
 
+	// Runtime dependencies.
+	Dependencies P `json:"dependencies"`
+
 	// Project identifier on [Anitya].
 	//
 	// [Anitya]: https://release-monitoring.org/