From adb5edce0ccc5c441121288920320ec588dd4850 Mon Sep 17 00:00:00 2001
From: Bryson Henneberger <591079+PushTheLimit@users.noreply.github.com>
Date: Tue, 25 Aug 2026 15:34:31 -0600
Subject: [PATCH] feat: evaluate only the parameter/preset/tag closure when
 rendering

Preview evaluates the entire Terraform module graph on every call, even though
rendering a workspace form only needs coder_parameter, coder_workspace_preset
and coder_workspace_tags (and what they reference). The resources a workspace
would create cannot feed those blocks, so evaluating them is wasted work that
dominates request latency on large templates.

Pass OptionWithResourceClosure with the three target block types so the parser
drops root-module resources that nothing in that closure references. On a real
template this cuts EvaluateAll from ~2s to ~0.16s (~12x) with byte-identical
parameters, presets and tags.

Depends on the OptionWithResourceClosure addition in the trivy fork
(coder/trivy#74). The trivy replace is temporarily pinned to that PR's commit;
it will be moved to the merged coder/trivy commit before this merges.
---
 go.mod     |  2 +-
 go.sum     |  4 ++++
 preview.go | 10 ++++++++++
 3 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/go.mod b/go.mod
index 5e2285e..721cb89 100644
--- a/go.mod
+++ b/go.mod
@@ -159,4 +159,4 @@ require (
 
 // Trivy has some issues that we're floating patches for, and will hopefully
 // be upstreamed eventually.
-replace github.com/aquasecurity/trivy => github.com/coder/trivy v0.0.0-20260309164037-c413f5a2f511
+replace github.com/aquasecurity/trivy => github.com/PushTheLimit/trivy v0.0.0-20260825213047-3916002b18a9
diff --git a/go.sum b/go.sum
index 1b7c977..893f141 100644
--- a/go.sum
+++ b/go.sum
@@ -38,6 +38,10 @@ github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERo
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
 github.com/ProtonMail/go-crypto v1.4.1 h1:9RfcZHqEQUvP8RzecWEUafnZVtEvrBVL9BiF67IQOfM=
 github.com/ProtonMail/go-crypto v1.4.1/go.mod h1:e1OaTyu5SYVrO9gKOEhTc+5UcXtTUa+P3uLudwcgPqo=
+github.com/PushTheLimit/trivy v0.0.0-20260825211335-fa2a87959259 h1:vba8EkcoWWGRr6nTNFspGAESDHswMwBLAz+y0XqxtfU=
+github.com/PushTheLimit/trivy v0.0.0-20260825211335-fa2a87959259/go.mod h1:+zF17ZBOdhFWwD3+GkLxZ/vkmKLudoOtt+hgnc1TQpA=
+github.com/PushTheLimit/trivy v0.0.0-20260825213047-3916002b18a9 h1:9cCoooPV3k63sQdDY0E0eFutFgy+avEMdWaWm6jc7qc=
+github.com/PushTheLimit/trivy v0.0.0-20260825213047-3916002b18a9/go.mod h1:+zF17ZBOdhFWwD3+GkLxZ/vkmKLudoOtt+hgnc1TQpA=
 github.com/agext/levenshtein v1.2.3 h1:YB2fHEn0UJagG8T1rrWknE3ZQzWM06O8AMAatNn7lmo=
 github.com/agext/levenshtein v1.2.3/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
 github.com/alecthomas/chroma v0.10.0 h1:7XDcGkCQopCNKjZHfYrNLraA+M7e0fMiJ/Mfikbfjek=
diff --git a/preview.go b/preview.go
index 32ac43f..f41e08b 100644
--- a/preview.go
+++ b/preview.go
@@ -243,6 +243,16 @@ func Preview(ctx context.Context, input Input, dir fs.FS) (output *Output, diagn
 		parser.OptionWithEvalHook(ownerHook),
 		parser.OptionWithWorkingDirectoryPath("/"),
 		parser.OptionWithEvalHook(parameterContextsEvalHook(input)),
+		// Only the parameter/preset/tag blocks and what they reference need to be
+		// evaluated to render a workspace form. The resources a workspace would
+		// create cannot feed those blocks, so pruning the ones nothing references
+		// avoids evaluating the entire module graph on every request without
+		// changing any parameter, preset or tag. See OptionWithResourceClosure.
+		parser.OptionWithResourceClosure([]string{
+			"coder_parameter",
+			"coder_workspace_preset",
+			"coder_workspace_tags",
+		}),
 		// 'OptionsWithTfVars' cannot be set with 'OptionWithTFVarsPaths'. So load the
 		// tfvars from the files ourselves and merge with the user-supplied tf vars.
 		parser.OptionsWithTfVars(variableValues),