tree 49926b2666cd492cad6ec20e4d24528f81ef8158
parent 68e135526f21b8d2d8124e4490e88f5bbfa33664
author Hana <hyangah@gmail.com> 1651845198 -0400
committer Hyang-Ah Hana Kim <hyangah@gmail.com> 1652222442 +0000

src/goVulncheck: replace gopls custom command with `gopls vulncheck`

We learned that it is better to run the vulncheck analysis outside
the main gopls process because

- The custom vulncheck message blocks all the LSP messages
including the workDoneProgress cancellation message. For a large
project, the vulncheck can take a while to complete. Blocking
gopls's normal operation and not being able to cancel the task
is not ideal.

- The vulncheck may panic. The panics sometimes occur in goroutines
created inside libraries that we cannot control, and thus we cannot
recover from the panic either. Bringing down the main gopls isn't
a great experience either.

`gopls vulncheck` outputs a JSON-encoded VulncheckResult message.
`gopls vulncheck` can be thought as `govulncheck` shipped with
`gopls` which most users already have, and outputs the results
in the format editors can utilize.

This change allows cancellation of a long running analysis by killing
the command.

This allows us to prevent the panics from killing the main gopls.

This also forwards stderr to the output channel and as the progress
report.

Fixes golang/vscode-go#2185
Fixes golang/vscode-go#2186
Fixes golang/vscode-go#2214

Change-Id: Icd9f04ee3f3dc8379d832c224b5397d5f57c2b4e
Reviewed-on: https://go-review.googlesource.com/c/vscode-go/+/404576
Run-TryBot: Hyang-Ah Hana Kim <hyangah@gmail.com>
TryBot-Result: kokoro <noreply+kokoro@google.com>
Reviewed-by: Jamal Carvalho <jamal@golang.org>