forcedotcom / forcedotcom/code-analyzer

[BUG][code-analyzer] `sf code-analyzer run ...` causes Windows Defender to spike the CPU

Open
#1,796 4 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
240
Forks
52
Avg merge
1d 23h
Merged PRs (30d)
5

Description

### Have you tried to resolve this issue yourself first?

Yes

### Bug Description

Any time that I run `sf code-analyzer run ...`, I almost immediately see a CPU spike, and `MsMpEng` is right alongside the host `node` process in CPU consumption:

![Image](https://github.com/user-attachments/assets/ee30d7b6-7d7f-4ca9-93d7-5f08baa7ea53)

The directory containing Salesforce projects is already in the exclusion list, and I don't see any issues running other `sf` commands from these projects. I'm guessing that something else being executed by Code Analyzer needs to be excluded, no? Any idea what that would be? I'm not comfortable excluding `node` altogether for what I hope are obvious reasons.

### Output / Logs

I also timed command execution with and without Defender active, and the impact is pretty significant:

**Defender enabled:** 2m6.395s
**Defender disabled:** 0m49.501s

### Steps To Reproduce

Run Code Analyzer on Windows with Defender enabled.

### Expected Behavior

There's some safe way to configure Windows Defender exclusions so that Code Analyzer can run without spiking the CPU.

### Operating System

Windows 11

### Salesforce CLI Version

@salesforce/cli/2.87.7 win32-arm64 node-v22.13.0

### Code Analyzer Plugin (@salesforce/sfdx-scanner) Version

code-analyzer 5.0.0 (5.0.0)

### Additional Context (Screenshots, Files, etc)

_No response_

### Workaround

_No response_

### Urgency

Low

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.