fix quickstyle: prefer repo tools and cache goimports

[vikin91]

What

Updated quickstyle to be more reliable in StackRox repos by resolving Go tooling via repo-managed binaries when available and by ensuring required tools exist.

Why

Running quickstyle against stackrox repo could fail for non-style reasons.

Before this change

• Stale roxvet from GOPATH/bin: quickstyle would use $(go env GOPATH)/bin/roxvet if present. If it was built with an older Go version than the target repo’s toolchain, it could error with “package requires newer Go version …” and/or panic (e.g. pkgbits unsupported version: 2).
• Missing goimports: quickstyle called goimports directly without ensuring it exists, so environments without goimports on PATH failed with goimports: command not found.
• Repo toolchain not respected: repos like stackrox manage tools under .gotools/bin (via make which-*), but quickstyle didn’t prefer those canonical binaries, so results depended on whatever was installed globally.

This change makes quickstyle prefer repo toolchain wiring (via make which-*) and provides a workflow-managed fallback for goimports.

Changes

• Prefer repo-provided tool binaries via make which-<tool> when available (e.g. gotools-based roxvet, golangci-lint).
• Detect stale GOPATH/bin/roxvet (Go major/minor mismatch) and rebuild it when possible.
• Ensure goimports is available by installing it into a workflow cache (pinned to the repo’s golang.org/x/tools version when available) and reusing it.
• Add doc comments for the new helper functions for maintainability.

How I validated my change

• Reproduced the failure mode in stackrox by running:
  • cd ../stackrox && ../workflow/bin/quickstyle
• Verified the updated script:
  • no longer fails with goimports: command not found
  • no longer panics due to stale roxvet (and uses/rebuilds a compatible roxvet)
  • still reports real style findings from the repo (expected).

Example run after the changes:

$ pushd ../stackrox2 && quickstyle || popd

~/src/go/src/github.com/stackrox/stackrox2 ~/src/go/src/github.com/stackrox/workflow
[INFO] 10 files changed from master, 10 changed since the last successful quickstyle run.
[INFO] Adding missing newlines...
[INFO] Running go style checks...
[INFO] golangci-lint
sensor/kubernetes/fake/virtualmachines.go:337:70: printf: (github.com/stackrox/rox/pkg/logging.Logger).Debugf format %s has arg vsockCID of wrong type uint32 (govet)
                        log.Debugf("Stopping index report generation for VM with vsockCID %s (lifecycle ended)", vsockCID)
                                                                                          ^
1 issues:
* govet: 1
[INFO] imports
[INFO] blanks
[INFO] fmt
[INFO] roxvet
[INFO] staticcheck
[WARN] Skipping staticcheck, doesn't appear to be supported in the repo.
[FATAL] Style errors were found
~/src/go/src/github.com/stackrox/workflow

AI / human attribution

• AI: implemented the tool-resolution logic (make which-* + fallbacks), goimports caching/installation behavior, and helper-function documentation.
• Human: provided requirements, executed the reproduction/validation runs, and reviewed/accepted the changes.

[vikin91]

This change is part of the following stack:

• fix quickstyle: prefer repo tools and cache goimports #116 ◀

_{Change managed by git-spice.}

[janisz]

Tested! It's working for me:

before I have a lot of similar panics

# go.uber.org/zap/internal/exit
panic: assertion failed [recovered]
	panic: assertion failed

now:

quickstyle    
[INFO] 4 files changed from master, 4 changed since the last successful quickstyle run.
[INFO] Adding missing newlines...
[INFO] Running go style checks...
[INFO] golangci-lint
0 issues.
[INFO] imports
[INFO] blanks
[INFO] fmt
[INFO] roxvet
[INFO] staticcheck
[WARN] Skipping staticcheck, doesn't appear to be supported in the repo.