cmd/vulnreport: add cpuprofile option to vulnreport

This will allow us to identify bottlenecks in the vulnreport command.

Change-Id: I4e9a3376dba2d7fd807ef812622eed0812596fb5
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/459641
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Julie Qiu <julieqiu@google.com>
Reviewed-by: Tatiana Bradley <tatiana@golang.org>
Run-TryBot: Tatiana Bradley <tatiana@golang.org>
diff --git a/cmd/vulnreport/main.go b/cmd/vulnreport/main.go
index 7bd383c..c185ceb 100644
--- a/cmd/vulnreport/main.go
+++ b/cmd/vulnreport/main.go
@@ -19,6 +19,7 @@
 	"path/filepath"
 	"regexp"
 	"runtime"
+	"runtime/pprof"
 	"sort"
 	"strconv"
 	"strings"
@@ -49,6 +50,7 @@
 	updateIssue   = flag.Bool("up", false, "for commit, create a CL that updates (doesn't fix) the tracking bug")
 	indent        = flag.Bool("indent", false, "for newcve, indent JSON output")
 	closedOk      = flag.Bool("closed-ok", false, "for create & create-excluded, allow closed issues to be created")
+	cpuprofile    = flag.String("cpuprofile", "", "write cpuprofile to file")
 )
 
 func main() {
@@ -90,6 +92,16 @@
 		args = flag.Args()[1:]
 	}
 
+	// Start CPU profiler.
+	if *cpuprofile != "" {
+		f, err := os.Create(*cpuprofile)
+		if err != nil {
+			log.Fatal(err)
+		}
+		pprof.StartCPUProfile(f)
+		defer pprof.StopCPUProfile()
+	}
+
 	// setupCreate clones the CVEList repo and can be very slow,
 	// so commands that require this functionality are separated from other
 	// commands.