[PushTheLimit]

What

Add OptionWithResourceClosure(targetTypes []string) to the Terraform parser. When set, root-module resource blocks that are not reachable (via references) from the given target block types are dropped before evaluation. Default off, so existing callers are unaffected.

Why

EvaluateAll evaluates every resource and module in a module on each call. Callers that only need a subset of a module's output pay to evaluate resources whose values can never affect that output.

The concrete driver is coder/preview rendering a workspace form: it only needs coder_parameter / coder_workspace_preset / coder_workspace_tags and what they reference, but today the whole module graph is evaluated on every keystroke over the dynamic-parameters websocket. On a real Altana template this is ~2s of EvaluateAll per request; with this option it drops to ~0.16s locally (~12x), and the computed parameters, presets and tags are byte-identical.

How

• Seed a frontier from the references of every block that is neither a resource nor an output (variables, locals, data sources, providers, module arguments, and the target blocks themselves).
• Mark every resource reachable from that frontier, following references through resources that are themselves retained.
• Drop root-module resources that are not marked. Non-resource blocks are always retained and submodules are evaluated in full.

Safety

The retained set is the transitive reference closure of everything whose value can flow into a target block, so a resource is excluded only when nothing a target block reads can reference it: the evaluated values of the target blocks are unchanged. The closure is conservative, a reference that cannot be resolved to a concrete block keeps the matching blocks. If no target block is present, nothing is pruned.

Testing

• New resource_closure_test.go: an orphan resource is pruned, a resource referenced by a parameter transitively through a local is retained, and the parameter's computed default is unchanged. Also covers default-off and no-target-present.
• Existing pkg/iac/scanners/terraform/parser suite passes unchanged.

Base branch

Targets coder/preview_v0_69 (the line coder/preview currently pins) so it can flow into the deployed preview build; happy to also land it on main.

[Emyrk]

👍

[PushTheLimit]

@Emyrk pulled your indexed-ref fix in, thanks 🙏 Added a few more closure tests on top to lock down the other reference shapes: splat (x[*]), variable index (x[var.i]), a nested block ref, and a module input arg. All green, so the indexed-key case looks like the only spot that was over-pruning.

[Emyrk]

One more reference shape where the closure is not conservative: .tf.json files.

Attribute.referencesFromExpression special-cases *json.expression and passes all of expr.Variables() into a single createDotReferenceFromTraversal call, which concatenates the traversal parts into one Reference. An expression referencing two resources therefore yields a reference to the first only, and the second is pruned.

Repro (parser package):

{
  "data": {"coder_parameter": {"p": {"name": "p", "default": "${local.v}"}}},
  "locals": {"v": "${my_resource.a.name}-${my_resource.b.name}"},
  "resource": {"my_resource": {"a": {"name": "A"}, "b": {"name": "B"}}}
}

Without the option: 2 resources kept, default "A-B". With OptionWithResourceClosure([]string{"coder_parameter"}): 1 kept, default unknown.

The merging in the JSON path predates this PR, but pruning is what turns it from a quirk into wrong output. Iterating expr.Variables() one traversal at a time, as the hclsyntax path already does, would fix it; the alternative is to skip pruning when any .tf.json file is present. A failing end-to-end vector for this is going up in coder/preview alongside the other closure cases.

Posted by Emyrk with Coder Agents assistance.

[PushTheLimit]

Handled the .tf.json case 👍 Went the conservative route (your option B): the pruner now skips entirely when any source file is .tf.json/.tofu.json, with a regression test using your repro (two resources in one expression, default resolves to "A-B"). That keeps us out of the shared referencesFromExpression path. Option A (making the JSON path iterate Variables like hclsyntax does) is a real general fix, but it's your call on shared scanner code, and since our templates are all .tf we did not want to take on that blast radius for an opt-in optimization. Glad to help with A separately if you want the .tf.json speedup.

Two lint things the PR's new-vs-main lint surfaced that I also cleaned up:

• goconst on the "resource" literal my pruner added, so I pulled it into a const.
• a pre-existing revive unused-parameter on the eval-hook test from the v0.69 base (inputVars). I added a //nolint:revive with a reason to keep the descriptive name and get lint green, but it's your patch, so tell me how you would rather handle it (leave the nolint, rename to _, or you take it on the base) and I'll match.

Local run is clean: full parser package tests pass and golangci-lint new-vs-main reports 0 issues.