anchore/grype-vscode

Support multi-root workspaces

Opened this issue · 0 comments

At the time of writing, the Grype VS Code extension is designed around the expectation of a 1:1 relationship between projects and VS Code workspaces.

This implementation allows for what's probably the most common VS Code usage scenario. However, VS Code has a feature called multi-root workspaces that allows users to have multiple "root" directories (like repository root directories) within one "workspace", and thus within the same VS Code window.

It would be great if the Grype VS Code extension could be adapted to work within this model. As of #40, the extension will refuse to scan if the workspace has multiple directories. (For a more concrete look, see here: https://github.com/anchore/grype-vscode/pull/40/files#diff-ce5992b0f1fd716439a7c5143ace1224R300.) But going forward, this isn't a necessary limitation.

Some aspects to consider:

  1. What should show in the status bar? (Possible answers: a total count of all vulnerabilities across all roots, a delimited list of vulnerabilities for each root, etc.)
  2. How should the extension's activation process be updated (if at all)?
  3. What should a vulnerability report look like when multiple roots are present?
  4. Should individual roots have the option not to be automatically scanned while the remaining roots continue to be automatically scanned?
  5. How should workspace-specific state be handled, now that workspaces no longer map directly to roots?

Note: VS Code also provides an article for extension developers on considerations for updating extensions for multi-root workspaces: Adopting Multi Root Workspace APIs.