feat: terrascan - Improve performance during pre-commit --all (-a) run

[carlosbustillordguez]

Put an x into the box if that apply:

• This PR introduces breaking change.
• This PR fixes a bug.
• This PR adds new functionality.
• This PR enhances existing functionality.

Description of your changes

Close #309

How has this code been tested

time pre-commit try-repo --ref 44ae15a https://github.com/carlosbustillordguez/pre-commit-terraform.git terrascan -a
===============================================================================
Using config:
===============================================================================
repos:
-   repo: https://github.com/carlosbustillordguez/pre-commit-terraform.git
    rev: 44ae15a
    hooks:
    -   id: terrascan
===============================================================================

[carlosbustillordguez]

Regarding HOOK_ID read-only global variable, currently is defined for terrascan hook. Should we define it for other hooks?

[MaxymVlasov]

Regarding HOOK_ID read-only global variable, currently is defined for terrascan hook. Should we define it for other hooks?

Yes, please

[carlosbustillordguez]

Regarding HOOK_ID read-only global variable, currently is defined for terrascan hook. Should we define it for other hooks?

Yes, please

Done! Please note that the following hooks are not using the common::per_dir_hook which can consume the HOOK_ID global read-only variable. The variable is defined but not used.

• infracost_breakdown
• terraform_docs
• terraform_fmt
• terraform_validate

For terraform_docs_replace hook, I didn't add the variable.

[yermulnik]

LGTM if @MaxymVlasov approves

[antonbabenko]

Looks very good (I didn't run it)!

I wonder if you can confirm that this change will work with a big repository like this one - https://github.com/terraform-aws-modules/terraform-aws-security-group ? And how much faster will it become?

Another consideration - spaces in the path. It is not often but it happens that people use spaces in the path and we need to make sure it works correctly.

[carlosbustillordguez]

Looks very good (I didn't run it)!

Thanks!

I wonder if you can confirm that this change will work with a big repository like this one - https://github.com/terraform-aws-modules/terraform-aws-security-group ? And how much faster will it become?

I tested the suggested repo against the code on this PR:

===============================================================================
Using config:
===============================================================================
repos:
-   repo: https://github.com/carlosbustillordguez/pre-commit-terraform
    rev: 976dc1d
    hooks:
    -   id: terrascan
===============================================================================

Test details:

5 runs 'terrascan PR 327#pullrequestreview-871100755'

time command	max	min	mean	median
users seconds	9.31	8.91	9.076	9.05
system seconds	0.45	0.27	0.362	0.37
CPU %	115	108	112	113
Total time	8.6	8.06	8.4	8.4

Run details

• Test Start: Thu Feb 3 19:04:49 UTC 2022
• Test End: Thu Feb 3 19:05:31 UTC 2022

Variable name	Value
TEST_NUM	5
TEST_COMMAND	pre-commit try-repo --ref 976dc1d https://github.com/carlosbustillordguez/pre-commit-terraform terrascan -a
TEST_DIR	/home/carlos/testing/pre-commit-terraform-tests/big-module/terraform-aws-security-group
TEST_DESCRIPTION	5 runs 'terrascan PR 327#pullrequestreview-871100755'
RAW_TEST_RESULTS_FILE_NAME	terrascan_terraform-aws-security-group

Memory info (head -n 6 /proc/meminfo):

MemTotal:       26032556 kB
MemFree:        20210464 kB
MemAvailable:   23720044 kB
Buffers:          338640 kB
Cached:          3811452 kB
SwapCached:            0 kB

CPU info:

Real procs: 4
Virtual (hyper-threading) procs: 8

processor	: 7
vendor_id	: GenuineIntel
cpu family	: 6
model		: 140
model name	: 11th Gen Intel(R) Core(TM) i7-1165G7 @ 2.80GHz
stepping	: 1
microcode	: 0xffffffff
cpu MHz		: 2803.198
cache size	: 12288 KB
physical id	: 0
siblings	: 8
core id		: 3
cpu cores	: 4
apicid		: 7
initial apicid	: 7
fpu		: yes
fpu_exception	: yes
cpuid level	: 21
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ss ht syscall nx pdpe1gb rdtscp lm constant_tsc rep_good nopl xtopology tsc_reliable nonstop_tsc cpuid pni pclmulqdq ssse3 fma cx16 pcid sse4_1 sse4_2 movbe popcnt aes xsave avx f16c rdrand hypervisor lahf_lm abm 3dnowprefetch invpcid_single ssbd ibrs ibpb stibp ibrs_enhanced fsgsbase bmi1 avx2 smep bmi2 erms invpcid avx512f avx512dq rdseed adx smap avx512ifma clflushopt clwb avx512cd sha_ni avx512bw avx512vl xsaveopt xsavec xgetbv1 xsaves avx512vbmi umip avx512_vbmi2 gfni vaes vpclmulqdq avx512_vnni avx512_bitalg avx512_vpopcntdq rdpid fsrm avx512_vp2intersect flush_l1d arch_capabilities
bugs		: spectre_v1 spectre_v2 spec_store_bypass swapgs
bogomips	: 5606.39
clflush size	: 64
cache_alignment	: 64
address sizes	: 39 bits physical, 48 bits virtual
power management:

Test against the current release:

===============================================================================
Using config:
===============================================================================
repos:
-   repo: https://github.com/antonbabenko/pre-commit-terraform
    rev: v1.62.3
    hooks:
    -   id: terrascan
===============================================================================

Test details:

5 runs 'terrascan pre-commit-terraform v1.62.3'

time command	max	min	mean	median
users seconds	125.23	122.7	124.432	124.61
system seconds	6.38	5.94	6.2	6.27
CPU %	182	179	181.4	182
Total time	73.18	70.4	71.794	71.74

Run details

• Test Start: Thu Feb 3 19:19:47 UTC 2022
• Test End: Thu Feb 3 19:25:46 UTC 2022

Variable name	Value
TEST_NUM	5
TEST_COMMAND	pre-commit try-repo --ref v1.62.3 https://github.com/antonbabenko/pre-commit-terraform terrascan -a
TEST_DIR	/home/carlos/testing/pre-commit-terraform-tests/big-module/terraform-aws-security-group
TEST_DESCRIPTION	5 runs 'terrascan pre-commit-terraform v1.62.3'
RAW_TEST_RESULTS_FILE_NAME	terrascan-v1.62.3_terraform-aws-security-group

Memory info (head -n 6 /proc/meminfo):

MemTotal:       26032556 kB
MemFree:        19494044 kB
MemAvailable:   23009248 kB
Buffers:          341248 kB
Cached:          3813972 kB
SwapCached:            0 kB

CPU info:

Real procs: 4
Virtual (hyper-threading) procs: 8

processor	: 7
vendor_id	: GenuineIntel
cpu family	: 6
model		: 140
model name	: 11th Gen Intel(R) Core(TM) i7-1165G7 @ 2.80GHz
stepping	: 1
microcode	: 0xffffffff
cpu MHz		: 2803.198
cache size	: 12288 KB
physical id	: 0
siblings	: 8
core id		: 3
cpu cores	: 4
apicid		: 7
initial apicid	: 7
fpu		: yes
fpu_exception	: yes
cpuid level	: 21
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ss ht syscall nx pdpe1gb rdtscp lm constant_tsc rep_good nopl xtopology tsc_reliable nonstop_tsc cpuid pni pclmulqdq ssse3 fma cx16 pcid sse4_1 sse4_2 movbe popcnt aes xsave avx f16c rdrand hypervisor lahf_lm abm 3dnowprefetch invpcid_single ssbd ibrs ibpb stibp ibrs_enhanced fsgsbase bmi1 avx2 smep bmi2 erms invpcid avx512f avx512dq rdseed adx smap avx512ifma clflushopt clwb avx512cd sha_ni avx512bw avx512vl xsaveopt xsavec xgetbv1 xsaves avx512vbmi umip avx512_vbmi2 gfni vaes vpclmulqdq avx512_vnni avx512_bitalg avx512_vpopcntdq rdpid fsrm avx512_vp2intersect flush_l1d arch_capabilities
bugs		: spectre_v1 spectre_v2 spec_store_bypass swapgs
bogomips	: 5606.39
clflush size	: 64
cache_alignment	: 64
address sizes	: 39 bits physical, 48 bits virtual
power management:

From the above results, we can see that the code of this PR has a significant improvement (x8 faster) compared with the current release (v1.62.3).

Another consideration - spaces in the path. It is not often but it happens that people use spaces in the path and we need to make sure it works correctly.

I made a test as follows:

TEST_NUM=5
TEST_DIR='/home/carlos/testing/pre-commit-terraform-tests/big module with spaces/terraform-aws-security-group'
TEST_DESCRIPTION='`terrascan` PR 327#pullrequestreview-871100755 with spaces in the path'
RAW_TEST_RESULTS_FILE_NAME='terrascan_terraform-aws-security-group-spaces_in_the_path'

TEST_COMMAND="pre-commit try-repo --ref 976dc1d https://github.com/carlosbustillordguez/pre-commit-terraform terrascan -a"

./hooks_performance_test.sh "$TEST_NUM" "$TEST_COMMAND" "$TEST_DIR" "$TEST_DESCRIPTION" "$RAW_TEST_RESULTS_FILE_NAME"

and it works, but I am not sure is a valid test because the path with spaces is inside simple quotes...

Also, I ran pre-commit from a path with spaces and it works:

 ~/testing/pre-commit-terraform-tests/big module with spaces/terraform-aws-security-group   master 
 pre-commit try-repo --ref 976dc1d https://github.com/carlosbustillordguez/pre-commit-terraform.git terrascan -a
===============================================================================
Using config:
===============================================================================
repos:
-   repo: https://github.com/carlosbustillordguez/pre-commit-terraform.git
    rev: 976dc1d
    hooks:
    -   id: terrascan
===============================================================================
...
Scan Summary -

        File/Folder         :   /home/carlos/testing/pre-commit-terraform-tests/big module with spaces/terraform-aws-security-group
        IaC Type            :   terraform
        Scanned At          :   2022-02-03 20:03:52.091596863 +0000 UTC
        Policies Validated  :   50
        Violated Policies   :   13
        Low                 :   1
        Medium              :   0
        High                :   12

Please, note a path with spaces in the "Scan Summary".

[MaxymVlasov]

Works fine.
Ready to merge, @antonbabenko

[antonbabenko]

This PR is included in version 1.63.0 🎉