feat(terraform): prune resources outside the target block closure - #74
Open
PushTheLimit wants to merge 1 commit into
Open
feat(terraform): prune resources outside the target block closure#74PushTheLimit wants to merge 1 commit into
PushTheLimit wants to merge 1 commit into
Conversation
EvaluateAll evaluates every resource and module in a module on each call. Callers that only need a subset of a module's output (for example coder/preview, which computes a workspace's input parameters) pay to evaluate resources whose values can never affect that output. OptionWithResourceClosure(targetTypes) restricts root-module evaluation to the resource blocks reachable, via references, from the given target block types (matched on a block's type label, e.g. "coder_parameter"). Every non-resource block is retained and submodules are evaluated in full, so the computed values of the target blocks are unchanged; only resources that nothing in the target closure references are dropped. The closure is conservative: a reference that cannot be resolved to a concrete block keeps the matching blocks, so a resource is excluded only when nothing a target block reads can reference it. Empty targetTypes disables the behavior (default).
PushTheLimit
force-pushed
the
preview/target-closure-eval
branch
from
August 25, 2026 21:30
fa2a879 to
3916002
Compare
PushTheLimit
added a commit
to PushTheLimit/preview
that referenced
this pull request
Aug 25, 2026
Preview evaluates the entire Terraform module graph on every call, even though rendering a workspace form only needs coder_parameter, coder_workspace_preset and coder_workspace_tags (and what they reference). The resources a workspace would create cannot feed those blocks, so evaluating them is wasted work that dominates request latency on large templates. Pass OptionWithResourceClosure with the three target block types so the parser drops root-module resources that nothing in that closure references. On a real template this cuts EvaluateAll from ~2s to ~0.16s (~12x) with byte-identical parameters, presets and tags. Depends on the OptionWithResourceClosure addition in the trivy fork (coder/trivy#74). The trivy replace is temporarily pinned to that PR's commit; it will be moved to the merged coder/trivy commit before this merges.
PushTheLimit
marked this pull request as ready for review
August 26, 2026 04:18
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Add
OptionWithResourceClosure(targetTypes []string)to the Terraform parser. When set, root-moduleresourceblocks that are not reachable (via references) from the given target block types are dropped before evaluation. Default off, so existing callers are unaffected.Why
EvaluateAllevaluates every resource and module in a module on each call. Callers that only need a subset of a module's output pay to evaluate resources whose values can never affect that output.The concrete driver is
coder/previewrendering a workspace form: it only needscoder_parameter/coder_workspace_preset/coder_workspace_tagsand what they reference, but today the whole module graph is evaluated on every keystroke over the dynamic-parameters websocket. On a real Altana template this is ~2s ofEvaluateAllper request; with this option it drops to ~0.16s locally (~12x), and the computed parameters, presets and tags are byte-identical.How
resourcenor anoutput(variables, locals, data sources, providers, module arguments, and the target blocks themselves).resourcereachable from that frontier, following references through resources that are themselves retained.Safety
The retained set is the transitive reference closure of everything whose value can flow into a target block, so a resource is excluded only when nothing a target block reads can reference it: the evaluated values of the target blocks are unchanged. The closure is conservative, a reference that cannot be resolved to a concrete block keeps the matching blocks. If no target block is present, nothing is pruned.
Testing
resource_closure_test.go: an orphan resource is pruned, a resource referenced by a parameter transitively through alocalis retained, and the parameter's computed default is unchanged. Also covers default-off and no-target-present.pkg/iac/scanners/terraform/parsersuite passes unchanged.Base branch
Targets
coder/preview_v0_69(the linecoder/previewcurrently pins) so it can flow into the deployed preview build; happy to also land it onmain.