vulncheck: make module IDs deterministic

To facilitate testing by diffing a golden, ensure that module IDs are
assigned deterministically.

Change-Id: Iae2312aa1afd1ce2164a0eac8f29021cdb6a27c0
Reviewed-on: https://go-review.googlesource.com/c/vuln/+/400115
Run-TryBot: Jonathan Amsterdam <jba@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Zvonimir Pavlinovic <zpavlinovic@google.com>
diff --git a/vulncheck/source.go b/vulncheck/source.go
index 55f3777..9ceb993 100644
--- a/vulncheck/source.go
+++ b/vulncheck/source.go
@@ -9,6 +9,7 @@
 	"fmt"
 	"go/token"
 	"runtime"
+	"sort"
 
 	"golang.org/x/tools/go/callgraph"
 	"golang.org/x/tools/go/ssa"
@@ -178,7 +179,14 @@
 	// We first collect inverse requires by (predecessor)
 	// relation on module node ids.
 	modPredRelation := make(map[int]map[int]bool)
-	for _, pkgNode := range result.Imports.Packages {
+	// Sort keys so modules are assigned IDs deterministically, for tests.
+	var pkgIDs []int
+	for id := range result.Imports.Packages {
+		pkgIDs = append(pkgIDs, id)
+	}
+	sort.Ints(pkgIDs)
+	for _, id := range pkgIDs {
+		pkgNode := result.Imports.Packages[id]
 		// Create or get module node for pkgNode.
 		pkgModID := moduleNodeID(pkgNode, result, modNodeIDs)
 		pkgNode.Module = pkgModID