Per #53 (comment)

git-pkgs should deal appropriately with "dependencies" found in git submodules as well as those found as test fixtures (or similar). A straightforward solution would be to ignore them. Git submodule paths can be recognized by consulting the .gitmodules. Test fixtures probably require some heuristics like ignore any directory with "test", "spec", or "fixture" in it.

Some examples (for reference/testing):

• test/fixtures/no-lockfile/package-lock.json (in ericcornelissen/depreman@c476a1e) (tests)
• ODGen/Dockerfile (in ericcornelissen/odgen-action@2749c3b) (git submodule)
• ODGen/requirements.txt (in ericcornelissen/odgen-action@2749c3b) (git submodule)
• ODGen/src/esprima/package.json (in ericcornelissen/odgen-action@2749c3b) (git submodule)
• testdata/denoland-std/.github/workflows/ci.yml (ericcornelissen/js-regex-security-scanner@3d697a1) (git submodule)
• testdata/denoland-std/crypto/_wasm/Cargo.lock (ericcornelissen/js-regex-security-scanner@3d697a1) (git submodule)
• testdata/denoland-std/cli/testdata/unicode_width_crate/Cargo.toml (ericcornelissen/js-regex-security-scanner@3d697a1) (git submodule)