By making gopls.run_vulncheck_exp (RunVulncheckExp implements)
call `gopls vulncheck`, we achieve
- gopls.run_vulncheck_exp can run asynchronously and be cancellable
- log information can be forwarded as progress messages
- isolate any failures during vulncheck execution
In this CL, we also changed not to include test files in the analysis
(match the default of govulncheck). We will add an option in the future.
TODO:
- prevent concurrent gopls.run_vulncheck_exp
- convert the gopls vulncheck output to diagnostics and publish it
- remove timestamps from the `gopls vulncheck` log messages
for simplify progress messages
- add test to check vulnerability in third-party dependencies
Change-Id: I21592e03794cd9e9d96ed3989973a2ab7d75c538
Reviewed-on: https://go-review.googlesource.com/c/tools/+/420717
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Robert Findley <rfindley@google.com>
Reviewed-by: Suzy Mueller <suzmue@golang.org>
Run-TryBot: Hyang-Ah Hana Kim <hyangah@gmail.com>
gopls-CI: kokoro <noreply+kokoro@google.com>