fix: address code review feedback for requirements.txt preprocessing

- Revert getIgnoredDependencies to use raw lines so ignore markers
  (e.g. #trustify-da-ignore) in inline comments are not stripped
  before containsIgnorePattern runs; keep \R split fix
- Use compiled Pattern with \s-- for inline option stripping to handle
  tabs and multiple spaces, not just single space
- Add Windows drive-letter path filtering (C:\path, c:/path)
- Tighten :// URL check to only inspect the requirement part before
  markers, avoiding false positives from marker strings
- Add tests for Windows paths and final-line backslash edge case

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: a-oren

src/main/java/io/github/guacsec/trustifyda/providers/PythonPipProvider.java

@@ -95,9 +95,8 @@ public Content provideComponent() throws IOException {
 
   @Override
   protected Set<PackageURL> getIgnoredDependencies(String manifestContent) {
-    List<String> rawLines = Arrays.asList(manifestContent.split("\\R"));
-    List<String> preprocessed = PythonControllerBase.preprocessRequirementsLines(rawLines);
-    return preprocessed.stream()
+    String[] lines = manifestContent.split("\\R");
+    return Arrays.stream(lines)
         .filter(this::containsIgnorePattern)
         .map(PythonPipProvider::extractDepFull)
         .map(this::splitToNameVersion)

src/main/java/io/github/guacsec/trustifyda/utils/PythonControllerBase.java

@@ -35,6 +35,8 @@
 import java.util.List;
 import java.util.Map;
 import java.util.logging.Logger;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
@@ -372,6 +374,9 @@ protected String getDependencyNameShow(String pipShowOutput) {
     return versionToken.substring(0, endOfLine).trim();
   }
 
+  private static final Pattern INLINE_OPTION_PATTERN = Pattern.compile("\\s--");
+  private static final Pattern WINDOWS_DRIVE_PATH_PATTERN = Pattern.compile("^[a-zA-Z]:[/\\\\]");
+
   /**
    * Preprocesses raw requirements.txt lines by joining line continuations, stripping inline
    * options, and filtering out pip option lines, URLs, local paths, and empty/comment lines.
@@ -404,8 +409,11 @@ public static List<String> preprocessRequirementsLines(List<String> rawLines) {
       if (line.startsWith("-")) {
         continue;
       }
-      // Filter out local path requirements (./path, ../path, /abs/path)
-      if (line.startsWith("./") || line.startsWith("../") || line.startsWith("/")) {
+      // Filter out local path requirements (./path, ../path, /abs/path, C:\path, C:/path)
+      if (line.startsWith("./")
+          || line.startsWith("../")
+          || line.startsWith("/")
+          || WINDOWS_DRIVE_PATH_PATTERN.matcher(line).find()) {
         continue;
       }
       // Strip PEP 508 direct references (name @ url -> name) before URL check
@@ -414,12 +422,14 @@ public static List<String> preprocessRequirementsLines(List<String> rawLines) {
         line = line.substring(0, atIndex).trim();
       }
       // Strip inline pip options (--hash=..., --config-settings=..., etc.)
-      int optionIndex = line.indexOf(" --");
-      if (optionIndex != -1) {
-        line = line.substring(0, optionIndex).trim();
+      Matcher optionMatcher = INLINE_OPTION_PATTERN.matcher(line);
+      if (optionMatcher.find()) {
+        line = line.substring(0, optionMatcher.start()).trim();
       }
-      // Filter out bare URLs and VCS URLs (any line containing :// is not a package name)
-      if (line.contains("://")) {
+      // Filter out bare URLs and VCS URLs — check the requirement part (before any marker)
+      // to avoid false positives from marker strings
+      String requirementPart = line.contains(";") ? line.substring(0, line.indexOf(";")) : line;
+      if (requirementPart.contains("://")) {
         continue;
       }
       if (!line.isEmpty()) {

src/test/java/io/github/guacsec/trustifyda/utils/PythonControllerBaseTest.java

@@ -2164,6 +2164,25 @@ void preprocessRequirementsLines_filters_local_paths() {
     assertEquals(List.of("requests==2.28.0"), result);
   }
 
+  @Test
+  void preprocessRequirementsLines_filters_windows_paths() {
+    List<String> input =
+        List.of(
+            "C:\\Users\\dev\\my-package",
+            "c:/projects/my-lib",
+            "D:\\packages\\MyPackage-1.0.tar.gz",
+            "requests==2.28.0");
+    List<String> result = PythonControllerBase.preprocessRequirementsLines(input);
+    assertEquals(List.of("requests==2.28.0"), result);
+  }
+
+  @Test
+  void preprocessRequirementsLines_handles_final_line_ending_with_backslash() {
+    List<String> input = List.of("flask==2.0.3", "requests==2.28.0 \\");
+    List<String> result = PythonControllerBase.preprocessRequirementsLines(input);
+    assertEquals(List.of("flask==2.0.3", "requests==2.28.0"), result);
+  }
+
   @Test
   void preprocessRequirementsLines_combined_scenario() {
     List<String> input =