From 3ca76fbebbb61ae807686e2c904cd109fff3d080 Mon Sep 17 00:00:00 2001
From: PushTheLimit <591079+PushTheLimit@users.noreply.github.com>
Date: Fri, 11 Sep 2026 12:28:25 -0600
Subject: [PATCH] feat: evaluate only the parameter/preset/tag closure when
 rendering

Preview evaluates the entire Terraform module graph on every call, even though
rendering a workspace form only needs coder_parameter, coder_workspace_preset
and coder_workspace_tags (and what they reference). The resources a workspace
would create cannot feed those blocks, so evaluating them is wasted work that
dominates request latency on large templates.

Pass OptionWithResourceClosure with the three target block types so the parser
drops root-module resources that nothing in that closure references. On a real
template this cuts EvaluateAll from ~2s to ~0.16s (~12x) with byte-identical
parameters, presets and tags.

Uses the OptionWithResourceClosure addition merged in coder/trivy#74; the trivy
replace points at that merged commit. Correctness is guarded by the resource
closure test corpus already in main (#223, #224).
---
 go.mod     |  2 +-
 go.sum     |  4 ++--
 preview.go | 10 ++++++++++
 3 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 353e2dd..3f057fb 100644
--- a/go.mod
+++ b/go.mod
@@ -159,4 +159,4 @@ require (
 
 // Trivy has some issues that we're floating patches for, and will hopefully
 // be upstreamed eventually.
-replace github.com/aquasecurity/trivy => github.com/coder/trivy v0.0.0-20260309164037-c413f5a2f511
+replace github.com/aquasecurity/trivy => github.com/coder/trivy v0.0.0-20260911135535-15b949537506
diff --git a/go.sum b/go.sum
index 70c9552..170f6f7 100644
--- a/go.sum
+++ b/go.sum
@@ -115,8 +115,8 @@ github.com/coder/serpent v0.10.0 h1:ofVk9FJXSek+SmL3yVE3GoArP83M+1tX+H7S4t8BSuM=
 github.com/coder/serpent v0.10.0/go.mod h1:cZFW6/fP+kE9nd/oRkEHJpG6sXCtQ+AX7WMMEHv0Y3Q=
 github.com/coder/terraform-provider-coder/v2 v2.8.0 h1:pbWfegCPI0v8eATgE8kGwIyuaMPgMRIcdLF2GTVkgG0=
 github.com/coder/terraform-provider-coder/v2 v2.8.0/go.mod h1:WrdLSbihuzH1RZhwrU+qmkqEhUbdZT/sjHHdarm5b5g=
-github.com/coder/trivy v0.0.0-20260309164037-c413f5a2f511 h1:wJS3Pk13VuCbV8hjrQRnOBCUwP3Islk91sMvbSdY0Vk=
-github.com/coder/trivy v0.0.0-20260309164037-c413f5a2f511/go.mod h1:+zF17ZBOdhFWwD3+GkLxZ/vkmKLudoOtt+hgnc1TQpA=
+github.com/coder/trivy v0.0.0-20260911135535-15b949537506 h1:A9f2UisugOgV2JlhibP0GZdzpqn+sWPIcz4q3bsgopI=
+github.com/coder/trivy v0.0.0-20260911135535-15b949537506/go.mod h1:+zF17ZBOdhFWwD3+GkLxZ/vkmKLudoOtt+hgnc1TQpA=
 github.com/coder/websocket v1.8.13 h1:f3QZdXy7uGVz+4uCJy2nTZyM0yTBj8yANEHhqlXZ9FE=
 github.com/coder/websocket v1.8.13/go.mod h1:LNVeNrXQZfe5qhS9ALED3uA+l5pPqvwXg3CKoDBB2gs=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
diff --git a/preview.go b/preview.go
index 32ac43f..f41e08b 100644
--- a/preview.go
+++ b/preview.go
@@ -243,6 +243,16 @@ func Preview(ctx context.Context, input Input, dir fs.FS) (output *Output, diagn
 		parser.OptionWithEvalHook(ownerHook),
 		parser.OptionWithWorkingDirectoryPath("/"),
 		parser.OptionWithEvalHook(parameterContextsEvalHook(input)),
+		// Only the parameter/preset/tag blocks and what they reference need to be
+		// evaluated to render a workspace form. The resources a workspace would
+		// create cannot feed those blocks, so pruning the ones nothing references
+		// avoids evaluating the entire module graph on every request without
+		// changing any parameter, preset or tag. See OptionWithResourceClosure.
+		parser.OptionWithResourceClosure([]string{
+			"coder_parameter",
+			"coder_workspace_preset",
+			"coder_workspace_tags",
+		}),
 		// 'OptionsWithTfVars' cannot be set with 'OptionWithTFVarsPaths'. So load the
 		// tfvars from the files ourselves and merge with the user-supplied tf vars.
 		parser.OptionsWithTfVars(variableValues),