Repository navigation
fix: bump coder/trivy to converge random_* values passed into modules - #231
Merged
Merged
Conversation
Picks up coder/trivy#84. Preview now settles on a result when a random_* resource value is passed into a module, and every submodule is evaluated on each pass.
BobbyHo
marked this pull request as ready for review
October 26, 2026 15:31
dylanhuff-at-coder
approved these changes
Oct 27, 2026
BobbyHo
added a commit
to coder/coder
that referenced
this pull request
Oct 27, 2026
… passed into modules (#31357) Update preview and Coder’s Trivy fork to fix dynamic parameters failing to settle when templates pass `random_*` values into modules. The upstream fix evaluates every submodule on each pass. - Bump preview to `155f674f1c7b` and Trivy to `65abc04915bd`. Both updates are required because Go ignores dependencies’ `replace` directives. - Only `go.mod` and `go.sum` change; no other module versions change. Regression tests live in the upstream Trivy fix. - `go build ./...` and targeted Coder tests pass. Template ranking tests fail intermittently on both this branch and unmodified `main`, but pass in isolation. Refs: [coder/trivy#84](coder/trivy#84), [coder/preview#231](coder/preview#231).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TL;DR
Preview uses Coder's fork of Trivy to evaluate Terraform templates. A fix for templates that pass a
random_*value into a module was merged into that fork in coder/trivy#84. Preview only picks up the fork at the exact commit named ingo.mod, so the fix does not reach preview on its own. This PR points preview at the commit that contains the fix.Refs coder/trivy#84
How to navigate this PR
go.mod: thereplaceline forgithub.com/aquasecurity/trivynow points togithub.com/coder/trivy v0.0.0-20261026151418-65abc04915bd.go.sum: the checksums for that version, created bygo mod tidy.Implementation
go.mod: moves the Trivyreplacefrom15b949537506to65abc04915bdon the fork'scoder/preview_v0_69branch.Expected Output
random_*resource value into a module now settles on a result, so preview stops getting stuck on that value.random_*values or modules behave the same as before.Testing
go build ./...andgo vet ./...pass.go test ./... -skip Test_VerifyE2Epasses.Test_VerifyE2E/plan_stringindexfails locally because thecoder/envbuilderv1.0.0 provider has no darwin_arm64 build. It fails the same way onmain, so this change did not cause it. CI runs on Linux and should not hit it.random_*value passed into a module. That could be added as a follow-up.