Skip to content

Conversation

@oittaa
Copy link
Contributor

@oittaa oittaa commented Jan 14, 2026

  • Implemented thread-safe GlobalCache (LRU) for expensive operations.
  • Optimized GetCallInfo with per-package AST node caching.
  • Cached GoVersion using sync.Once. -> Surprisingly profiling showed this to be a huge bottleneck on large code bases.
  • Implemented entropy / secrets pre-filtering.
  • Refactored #nosec directive parsing to avoid allocations.
  • Migrated multiple rules (G101, G111, G114, G306) to use centralized caching.
  • Verified 8.6x speedup on CockroachDB SQL package (37s -> 4.3s) and ~600MB memory reduction.

Performance Impact (Benchmarked on CockroachDB)

Metric Baseline Optimized Delta
Execution Time (SQL Pkg) 37.0s 4.29s 8.6x Speedup
Full Root Scan Time 47.0s 12.3s 3.8x Speedup
Peak Memory 2.0 GB 1.4 GB ~600 MB Reduction

- Implemented thread-safe GlobalCache (LRU) for expensive operations.
- Added zero-allocation GlobalKey struct to eliminate string concatenation.
- Optimized GetCallInfo with per-package AST node caching.
- Cached GoVersion using sync.Once.
- Implemented entropy pre-filtering and more efficient comment parsing.
- Migrated multiple rules (G101, G111, G114, G306) to use centralized caching.
- Verified ~8.6x speedup on CockroachDB (37s -> 4.3s) and ~600MB memory reduction.
@codecov-commenter
Copy link

codecov-commenter commented Jan 14, 2026

⚠️ Please install the 'codecov app svg image' to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 90.96045% with 16 lines in your changes missing coverage. Please review.
✅ Project coverage is 69.19%. Comparing base (1216c9b) to head (9ff395d).
⚠️ Report is 165 commits behind head on master.

Files with missing lines Patch % Lines
rules/hardcoded_credentials.go 80.00% 6 Missing and 1 partial ⚠️
helpers.go 72.72% 4 Missing and 2 partials ⚠️
analyzer.go 95.58% 2 Missing and 1 partial ⚠️
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.
Additional details and impacted files
@@            Coverage Diff             @@
##           master    #1467      +/-   ##
==========================================
+ Coverage   68.49%   69.19%   +0.69%     
==========================================
  Files          75       83       +8     
  Lines        4384     6516    +2132     
==========================================
+ Hits         3003     4509    +1506     
- Misses       1233     1785     +552     
- Partials      148      222      +74     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@oittaa
Copy link
Contributor Author

oittaa commented Jan 15, 2026

Now also fixes #1240

@oittaa
Copy link
Contributor Author

oittaa commented Jan 15, 2026

I also tried and abandoned some other optimization methods that didn't produce results. Maybe someone in the future is more successful in trying these.

  1. Pipeline architecture by separating file reading+load and AST+SSA to their own goroutines. -> It used a bit more memory but runtime didn't improve at all.
  2. Tried batch processing packages, but it just ate a whole lot more memory (multiples) and took more time.
  3. Caching loaded packages in hope that it would increase performance. There are many common packages that are often included, but at least on my computer the runtime didn't change at all even with very high cache hit ratio. Memory usage just rose significantly (~50%).

@oittaa
Copy link
Contributor Author

oittaa commented Jan 15, 2026

Here's another data point. Kubernetes scan time:

Version Time
v2.22.11 4min 8.95s
Master 44.85s
This 14.75s

@oittaa
Copy link
Contributor Author

oittaa commented Jan 16, 2026

Would you prefer if I split this into smaller changes? I just made this branch to investigate where the performance bottlenecks were and which ones were reasonably easy to tackle without going completely crazy. In the end this combination of changes seemed to offer a really nice balance of performance boosts without resorting to anything too weird.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants