forcedotcom / forcedotcom/code-analyzer
[BUG][code-analyzer] `sf code-analyzer run ...` causes Windows Defender to spike the CPU
- Dominant language
- TypeScript
- Stars
- 240
- Forks
- 52
- Avg merge
- 1d 23h
- Merged PRs (30d)
- 5
Description
### Have you tried to resolve this issue yourself first?
Yes
### Bug Description
Any time that I run `sf code-analyzer run ...`, I almost immediately see a CPU spike, and `MsMpEng` is right alongside the host `node` process in CPU consumption:

The directory containing Salesforce projects is already in the exclusion list, and I don't see any issues running other `sf` commands from these projects. I'm guessing that something else being executed by Code Analyzer needs to be excluded, no? Any idea what that would be? I'm not comfortable excluding `node` altogether for what I hope are obvious reasons.
### Output / Logs
I also timed command execution with and without Defender active, and the impact is pretty significant:
**Defender enabled:** 2m6.395s
**Defender disabled:** 0m49.501s
### Steps To Reproduce
Run Code Analyzer on Windows with Defender enabled.
### Expected Behavior
There's some safe way to configure Windows Defender exclusions so that Code Analyzer can run without spiking the CPU.
### Operating System
Windows 11
### Salesforce CLI Version
@salesforce/cli/2.87.7 win32-arm64 node-v22.13.0
### Code Analyzer Plugin (@salesforce/sfdx-scanner) Version
code-analyzer 5.0.0 (5.0.0)
### Additional Context (Screenshots, Files, etc)
_No response_
### Workaround
_No response_
### Urgency
Low
Contributor guide
Assessment
This issue has not been assessed yet.