Skip local dependencies for NPM packages

[varungandhi-src]

It would be good to figure out a way when a dependency is local (vs based on an NPM package in the registry) vs when it comes from the package registry. This affects both correctness and ergonomics:

• This is actually incorrect if a local dependency shadows something in the registry (e.g. you have a fork of a package).
• We can stop emitting warnings for these in the log (package not found in registry), since we don't need to make a request to the registry in the first place.

I don't think this information is communicated in the LSIF dump today, so we would need to fix that first.

[github-actions[bot]]

Heads up @macraig - the "team/code-intelligence" label was applied to this issue.

[varungandhi-src]

On studying the LSIF, I guess it does seem to be specified in an indirect way to some extent. Here is a subset of output from the client/web/ dump.

{"id":9,"type":"vertex","label":"packageInformation","name":"@sourcegraph/web","manager":"npm","version":"1.10.1"}
{"id":13802,"type":"vertex","label":"packageInformation","name":"@sourcegraph/extension-api-types","manager":"npm","version":"2.1.0","repository":{"type":"git","url":"https://github.com/sourcegraph/sourcegraph","directory":"client/extension-api-types"}}
{"id":50382,"type":"vertex","label":"packageInformation","name":"sourcegraph","manager":"npm","version":"25.5.0","repository":{"type":"git","url":"https://github.com/sourcegraph/sourcegraph","directory":"client/extension-api"}}
{"id":1208,"type":"vertex","label":"packageInformation","name":"@types/lodash","manager":"npm","version":"4.14.167","repository":{"type":"git","url":"https://github.com/DefinitelyTyped/DefinitelyTyped.git","directory":"types/lodash"}}
{"id":2462,"type":"vertex","label":"packageInformation","name":"rxjs","manager":"npm","version":"6.6.3","repository":{"type":"git","url":"https://github.com/reactivex/rxjs.git"}}
{"id":50415,"type":"vertex","label":"packageInformation","name":"@sourcegraph/common","manager":"npm","version":"0.0.1"}

Some observations:

• the repository field seems to be present for packages which are on NPM.
• the repository.directory field doesn't indicate if we're using the package based on the path or based on the package, it's only referring to whether the package is at the root of the git repo or not.

So checking for the repository field would be a partial solution. I suspect it's still not fully correct because it would make sense for the build to be using the local client/extension-api-types rather than a version downloaded from NPM.

[macraig]

@varungandhi-src is this still relevant with scip-typescript?

[varungandhi-src]

Yes, this is still applicable, it is a sub-task of the linked issue about different dependency kinds. Right now, we don't treat local dependencies differently, but we probably should.