feat(go): Add Go ecosystem support - Complete (Phases 1-4) (#40)

* feat(go): implement Phase 1 - core types and parser

Add Go ecosystem support for deps-lsp. This phase implements:

Core Types (types.rs):
- GoDependency with module_path, version, directive, indirect
- GoDirective enum (Require, Replace, Exclude, Retract)
- GoVersion with pseudo-version and retracted tracking
- GoMetadata with pkg.go.dev documentation URL

go.mod Parser (parser.rs):
- LineOffsetTable for O(log n) position lookups
- UTF-16 character position calculation for LSP
- Support for require, replace, exclude directives
- Multi-line block parsing with state machine
- Inline comment handling (including URL-aware // stripping)
- Indirect dependency marker extraction

Version Utilities (version.rs):
- Module path escaping (uppercase → !lowercase)
- Pseudo-version detection and base version extraction
- Semantic version comparison with +incompatible handling

Error Handling (error.rs):
- 10 error variants with thiserror integration
- Bidirectional deps_core::DepsError conversion
- Helper factory methods for common errors

Tests: 41 unit tests, all passing
Coverage: ~85% across all modules
Snapshots: insta snapshot tests for parser output

* feat(go): implement Phase 2 - registry client

Add GoRegistry for proxy.golang.org integration:
- HTTP client with HttpCache for ETag/Last-Modified caching
- get_versions() - fetch all available versions for a module
- get_version_info() - get metadata for specific version
- get_latest() - fetch latest stable version
- get_go_mod() - retrieve go.mod content for a version
- Module path escaping (uppercase to !lowercase)
- deps_core::Registry trait implementation

Security hardening:
- Module path length validation (max 500 chars)
- Version string validation (no path traversal, valid chars)
- Input sanitization before URL construction

Performance optimizations:
- Zero-copy parsing with std::str::from_utf8
- Synchronous parse functions (no async overhead)
- Efficient module path escaping with encode_utf8()

62 tests passing with comprehensive coverage.

* feat(go): implement Phase 3 - LSP features integration

Add full LSP support for Go modules (go.mod files):

GoFormatter (formatter.rs):
- Unquoted version format for go.mod
- Package URLs to pkg.go.dev
- Version matching with boundary checking
- URL encoding for special characters

GoEcosystem (ecosystem.rs):
- Ecosystem trait implementation for LSP handlers
- Inlay hints, hover, code actions, diagnostics
- Version completion from proxy.golang.org
- Retracted version filtering

LSP Integration (state.rs):
- Go variant in Ecosystem enum with go.mod detection
- UnifiedDependency::Go and UnifiedVersion::Go
- GoEcosystem registration in ServerState

Performance optimizations:
- Single-pass version completion (no double iteration)
- Parser Vec pre-allocation

690 tests passing.

* test(go): implement Phase 4 - comprehensive test coverage

Add 25 new tests to address critical coverage gaps:

Ecosystem Tests (ecosystem.rs):
- Inlay hint generation (up-to-date, needs update, no cache)
- Hover generation for module paths
- Code action generation
- Completion context detection (package name, version)
- Parse manifest error handling

State Integration Tests (state.rs):
- Ecosystem detection from filenames (go.mod)
- Ecosystem detection from URIs
- UnifiedDependency::Go variant methods
- UnifiedVersion::Go variant methods
- DocumentState Go ecosystem support

Coverage improvements:
- ecosystem.rs: 73% -> 83%
- state.rs: Go variants fully covered

713 tests passing (9 ignored for network access).

* docs: update READMEs and CI for Go ecosystem support

README updates:
- Add Go Modules to supported ecosystems table
- Add go.sum to lock file support list
- Add deps-go to project structure
- Create deps-go README with usage examples
- Update deps-core to mention deps-go

CI updates:
- Add deps-go to per-crate coverage generation
- Add codecov upload step for deps-go coverage

Other:
- Add **/snapshots/ to .gitignore

* feat(go): add go.sum lockfile parser

Implement LockFileProvider for Go ecosystem:
- Parse go.sum format (module_path version h1:hash)
- Skip /go.mod entries (module file checksums)
- Validate h1: prefix for checksums
- First occurrence wins (Go's MVS algorithm)
- Async file operations with staleness detection
- Workspace search (up to 5 levels)

Integration:
- GoEcosystem::lockfile_provider() returns GoSumParser
- Resolved versions now available for inlay hints

22 lockfile tests, 97.66% coverage.

* refactor(go): replace insta snapshot with assertions

- Rewrite test_parse_complex_go_mod to use regular assertions
- Remove insta dev-dependency from deps-go

Author: bug-ops

.github/workflows/ci.yml

@@ -215,7 +215,7 @@ jobs:
       - name: Generate per-crate coverage
         run: |
           # Generate coverage for each crate separately
-          for crate in deps-core deps-cargo deps-npm deps-pypi deps-lsp; do
+          for crate in deps-core deps-cargo deps-npm deps-pypi deps-go deps-lsp; do
             echo "Generating coverage for $crate..."
             cargo llvm-cov --all-features --package "$crate" --lcov \
               --output-path "lcov-$crate.info" nextest 2>/dev/null || true
@@ -261,6 +261,14 @@ jobs:
           flags: deps-pypi
           fail_ci_if_error: false
 
+      - name: Upload deps-go coverage
+        uses: codecov/codecov-action@v5
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: lcov-deps-go.info
+          flags: deps-go
+          fail_ci_if_error: false
+
       - name: Upload deps-lsp coverage
         uses: codecov/codecov-action@v5
         with:

.gitignore

@@ -14,6 +14,7 @@ target
 
 # Testing
 .snapshots/
+**/snapshots/
 
 # Local development
 .local/

Cargo.lock

@@ -19,6 +19,7 @@ deps-core = { version = "0.4.1", path = "crates/deps-core" }
 deps-cargo = { version = "0.4.1", path = "crates/deps-cargo" }
 deps-npm = { version = "0.4.1", path = "crates/deps-npm" }
 deps-pypi = { version = "0.4.1", path = "crates/deps-pypi" }
+deps-go = { version = "0.4.1", path = "crates/deps-go" }
 deps-lsp = { version = "0.4.1", path = "crates/deps-lsp" }
 futures = "0.3"
 insta = "1"
@@ -28,6 +29,7 @@ once_cell = "1.20"
 pep440_rs = "0.7"
 pep508_rs = "0.9"
 bytes = "1"
+regex = "1"
 reqwest = { version = "0.12", default-features = false }
 semver = "1"
 serde = "1"

Cargo.toml

@@ -14,7 +14,7 @@ A universal Language Server Protocol (LSP) server for dependency management acro
 
 - **Intelligent Autocomplete** — Package names, versions, and feature flags
 - **Version Hints** — Inlay hints showing latest available versions
-- **Lock File Support** — Reads resolved versions from Cargo.lock, package-lock.json, poetry.lock, uv.lock
+- **Lock File Support** — Reads resolved versions from Cargo.lock, package-lock.json, poetry.lock, uv.lock, go.sum
 - **Diagnostics** — Warnings for outdated, unknown, or yanked dependencies
 - **Hover Information** — Package descriptions with resolved version from lock file
 - **Code Actions** — Quick fixes to update dependencies
@@ -43,10 +43,14 @@ deps-lsp is optimized for responsiveness:
 | Rust/Cargo | `Cargo.toml` | ✅ Supported |
 | npm | `package.json` | ✅ Supported |
 | Python/PyPI | `pyproject.toml` | ✅ Supported |
+| Go Modules | `go.mod` | ✅ Supported |
 
 > [!NOTE]
 > PyPI support includes PEP 621, PEP 735 (dependency-groups), and Poetry formats.
 
+> [!NOTE]
+> Go support includes require, replace, and exclude directives with pseudo-version handling.
+
 ## Installation
 
 ### From crates.io
@@ -185,6 +189,7 @@ deps-lsp/
 │   ├── deps-cargo/     # Cargo.toml parser + crates.io registry
 │   ├── deps-npm/       # package.json parser + npm registry
 │   ├── deps-pypi/      # pyproject.toml parser + PyPI registry
+│   ├── deps-go/        # go.mod parser + proxy.golang.org
 │   ├── deps-lsp/       # Main LSP server
 │   └── deps-zed/       # Zed extension (WASM)
 ├── .config/            # nextest configuration

README.md

@@ -7,7 +7,7 @@
 
 Core abstractions for deps-lsp: traits, caching, and generic LSP handlers.
 
-This crate provides the shared infrastructure used by ecosystem-specific crates (`deps-cargo`, `deps-npm`, `deps-pypi`).
+This crate provides the shared infrastructure used by ecosystem-specific crates (`deps-cargo`, `deps-npm`, `deps-pypi`, `deps-go`).
 
 ## Features
 

crates/deps-core/README.md

@@ -0,0 +1,27 @@
+[package]
+name = "deps-go"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+authors.workspace = true
+license.workspace = true
+repository.workspace = true
+description = "Go module support for deps-lsp"
+
+[dependencies]
+deps-core = { workspace = true }
+async-trait.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+thiserror.workspace = true
+tokio.workspace = true
+tower-lsp-server.workspace = true
+tracing.workspace = true
+regex.workspace = true
+once_cell.workspace = true
+semver.workspace = true
+
+[dev-dependencies]
+tokio = { workspace = true, features = ["macros", "rt"] }
+tokio-test.workspace = true
+tempfile.workspace = true

crates/deps-go/Cargo.toml

@@ -0,0 +1,74 @@
+# deps-go
+
+[![Crates.io](https://img.shields.io/crates/v/deps-go)](https://crates.io/crates/deps-go)
+[![docs.rs](https://img.shields.io/docsrs/deps-go)](https://docs.rs/deps-go)
+[![codecov](https://codecov.io/gh/bug-ops/deps-lsp/graph/badge.svg?token=S71PTINTGQ&flag=deps-go)](https://codecov.io/gh/bug-ops/deps-lsp)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](../../LICENSE)
+
+Go modules support for deps-lsp.
+
+This crate provides parsing and registry integration for Go's module ecosystem.
+
+## Features
+
+- **go.mod Parsing** — Parse `go.mod` with position tracking for all directives
+- **Directive Support** — Handle `require`, `replace`, `exclude`, and `retract` directives
+- **Indirect Dependencies** — Detect and mark indirect dependencies (`// indirect`)
+- **Pseudo-versions** — Parse and validate Go pseudo-version format
+- **proxy.golang.org** — Fetch module versions from Go module proxy
+- **Module Path Escaping** — Proper URL encoding for uppercase characters
+- **EcosystemHandler** — Implements `deps_core::EcosystemHandler` trait
+
+## Usage
+
+```toml
+[dependencies]
+deps-go = "0.4"
+```
+
+```rust
+use deps_go::{parse_go_mod, GoRegistry};
+
+let dependencies = parse_go_mod(content, &uri)?;
+let registry = GoRegistry::new(cache);
+let versions = registry.get_versions("github.com/gin-gonic/gin").await?;
+```
+
+## Supported Directives
+
+### require
+
+```go
+require github.com/gin-gonic/gin v1.9.1
+require (
+    github.com/stretchr/testify v1.8.4
+    golang.org/x/sync v0.5.0 // indirect
+)
+```
+
+### replace
+
+```go
+replace github.com/old/module => github.com/new/module v1.0.0
+replace github.com/local/module => ../local/module
+```
+
+### exclude
+
+```go
+exclude github.com/pkg/module v1.2.3
+```
+
+## Pseudo-version Support
+
+Handles Go's pseudo-version format for unreleased commits:
+
+```
+v0.0.0-20191109021931-daa7c04131f5
+```
+
+Extracts base version and timestamp for display.
+
+## License
+
+[MIT](../../LICENSE)