cmd/govulncheck: make sure filepath are cross-platform

As of recent changes, our tests will produce relative paths. They can be
different depending on the system. This will make builders fail and,
more importantly, make govulncheck JSON non-portable. This CL makes sure
all paths use slashes.

Change-Id: I16ef56cfbdd5d762a5dd3d5ca5d7f66bbad021b5
Reviewed-on: https://go-review.googlesource.com/c/vuln/+/564095
Run-TryBot: Zvonimir Pavlinovic <zpavlinovic@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Ian Cottrell <iancottrell@google.com>

internal/govulncheck/govulncheck.go

@@ -156,6 +156,10 @@ type Frame struct {
 	// Position describes an arbitrary source position
 	// including the file, line, and column location.
 	// A Position is valid if the line number is > 0.
+	//
+	// The filenames are relative to the directory of
+	// the enclosing module and always use "/" for
+	// portability.
 	Position *Position `json:"position,omitempty"`
 }
 

internal/vulncheck/emit.go

@@ -133,6 +133,9 @@ func posFromStackEntry(e StackEntry, sink bool) *govulncheck.Position {
 // relative to the module of f. If it does not
 // have all the necessary information, returns
 // an empty string.
+//
+// The returned paths always use slash as separator
+// so they can work across different platforms.
 func pathRelativeToMod(path string, f *FuncNode) string {
 	if path == "" || f == nil || f.Package == nil { // sanity
 		return ""
@@ -154,7 +157,8 @@ func pathRelativeToMod(path string, f *FuncNode) string {
 	if err != nil {
 		return ""
 	}
-	return p
+	// make sure paths are portable.
+	return filepath.ToSlash(p)
 }
 
 // modDirWithVendor returns modDir if modDir is not empty.