forcedotcom / forcedotcom/code-analyzer
[BUG][code-analyzer] `sf code-analyzer run ...` causes Windows Defender to spike the CPU
- Lenguaje dominante
- TypeScript
- Estrellas
- 240
- Forks
- 52
- Merge medio
- 1 d 23 h
- PR fusionados (30 d)
- 5
Descripción
### Have you tried to resolve this issue yourself first?
Yes
### Bug Description
Any time that I run `sf code-analyzer run ...`, I almost immediately see a CPU spike, and `MsMpEng` is right alongside the host `node` process in CPU consumption:

The directory containing Salesforce projects is already in the exclusion list, and I don't see any issues running other `sf` commands from these projects. I'm guessing that something else being executed by Code Analyzer needs to be excluded, no? Any idea what that would be? I'm not comfortable excluding `node` altogether for what I hope are obvious reasons.
### Output / Logs
I also timed command execution with and without Defender active, and the impact is pretty significant:
**Defender enabled:** 2m6.395s
**Defender disabled:** 0m49.501s
### Steps To Reproduce
Run Code Analyzer on Windows with Defender enabled.
### Expected Behavior
There's some safe way to configure Windows Defender exclusions so that Code Analyzer can run without spiking the CPU.
### Operating System
Windows 11
### Salesforce CLI Version
@salesforce/cli/2.87.7 win32-arm64 node-v22.13.0
### Code Analyzer Plugin (@salesforce/sfdx-scanner) Version
code-analyzer 5.0.0 (5.0.0)
### Additional Context (Screenshots, Files, etc)
_No response_
### Workaround
_No response_
### Urgency
Low
Guía de contribución
Línea de trabajo
Empieza reproduciendo `sf code-analyzer run ...` en Windows 11 con Defender habilitado, usando code-analyzer 5.0.0 y la versión de CLI indicada; después compara el uso de CPU y el tiempo de ejecución con Defender deshabilitado. Investiga qué procesos o directorios de Code Analyzer activan el análisis de Defender. Se considera terminado cuando se documente o implemente una configuración segura de exclusión que evite el pico sin excluir Node globalmente.
Escrito por el modelo de indexación a partir del texto del issue.
Evaluación
- Stack tecnológico
- nodejs, typescript
- Área
- devtools, operating-systems, performance
- Tipo de issue
- Error
- Dificultad
- 4/5
- Tiempo estimado
- 3-5 días
- Estado de actividad
- Estancado
- Claridad
- Bastante claro
- Aptitud para principiantes
- 35/100