Download compatibility profiles lazily from a remote feed rather than shipping them

[rjmholt]

Currently compatibility profiles for the UseCompatibleTypes and UseCompatibleCommands rules ship with PSSA and effectively double its size.

This represents large overhead for users who don't use these rules or who don't want all the profiles we ship by default.

Ideally the rules should have a way of identifying filesystem and remote assets, and when rules are run, download/install any remote assets not already on the machine. This will also require cataloguing remote assets in a systematic and dependable way.

Proposed implementation

One solution is to have rules as NuGet assets (taking care of both hosting and caching), and specifying profiles as URIs, so that file:// and https:// (for example) profiles can be easily distinguished.

This may create an unnecessary dependency on NuGet however.

Whatever the implementation it will need to:

• Enable runtime retrieval of profiles so they do not need to be shipped with the PSSA module
• Allow side-by-side specification of remote and local profiles in the configuration in a way where local assets cannot have colliding names
• Memoise profile downloads, so that once they are downloaded once, they remain available locally by specifying the remote instance (this may require versioning or cache invalidation in case remote profiles change)
• Allow profiles to be downloaded in batches rather than one-at-a-time, for maximum efficiency (in the vein of the Remote Façade pattern.

[ghost]

A lot worse than "double its size," at least in some cases. In my installation as part of ms-vscode.powershell, compatibility_profiles takes up 278.1 MB out of 288.8 MB for all of PSScriptAnalyser!

[rjmholt]

Doubles the size of the compressed artefact. When installed, it's considerably larger

[kilasuit]

Can we not shell this out as a separate module that requires PSScriptAnalzyer for just the compatibility profiles?

[ForNeVeR]

JFYI, folks, we are having a problem with these files in intellij-powershell, and for now I'm going to just delete them from PSScriptAnalyzer bundled into our distribution. Everything else seems to work fine, and I am very hesitant to increase the unpacked plugin size tenfold in a new update :(

Some kind of on-demand downloading or consuming the compatibility rules in the packed form would be very nice.

I am ready to work/collaborate on this if you have an acceptable solution in mind. Or help on brainstorming if necessary.