forcedotcom / forcedotcom/code-analyzer

[BUG][code-analyzer] `sf code-analyzer run ...` causes Windows Defender to spike the CPU

Aperta
#1,796 4 commenti 0 reazioni 0 assegnatari Vedi su GitHub
Lingua principale
TypeScript
Stelle
240
Fork
52
Merge medio
1g 23h
PR unite (30g)
5

Descrizione

### Have you tried to resolve this issue yourself first?

Yes

### Bug Description

Any time that I run `sf code-analyzer run ...`, I almost immediately see a CPU spike, and `MsMpEng` is right alongside the host `node` process in CPU consumption:

![Image](https://github.com/user-attachments/assets/ee30d7b6-7d7f-4ca9-93d7-5f08baa7ea53)

The directory containing Salesforce projects is already in the exclusion list, and I don't see any issues running other `sf` commands from these projects. I'm guessing that something else being executed by Code Analyzer needs to be excluded, no? Any idea what that would be? I'm not comfortable excluding `node` altogether for what I hope are obvious reasons.

### Output / Logs

I also timed command execution with and without Defender active, and the impact is pretty significant:

**Defender enabled:** 2m6.395s
**Defender disabled:** 0m49.501s

### Steps To Reproduce

Run Code Analyzer on Windows with Defender enabled.

### Expected Behavior

There's some safe way to configure Windows Defender exclusions so that Code Analyzer can run without spiking the CPU.

### Operating System

Windows 11

### Salesforce CLI Version

@salesforce/cli/2.87.7 win32-arm64 node-v22.13.0

### Code Analyzer Plugin (@salesforce/sfdx-scanner) Version

code-analyzer 5.0.0 (5.0.0)

### Additional Context (Screenshots, Files, etc)

_No response_

### Workaround

_No response_

### Urgency

Low

Guida per i contributori

Apri la guida per i contributori

Direzione di ricerca

Start by reproducing `sf code-analyzer run ...` on Windows 11 with Defender enabled, using code-analyzer 5.0.0 and the reported CLI version, then compare CPU usage and timing with Defender disabled. Investigate which Code Analyzer processes or directories trigger Defender scanning. Done means documenting or implementing a safe exclusion configuration that avoids the spike without excluding Node globally.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Valutazione

Stack tecnologico
nodejs, typescript
Ambito
devtools, operating-systems, performance
Tipo di issue
Bug
Difficoltà
4/5
Tempo stimato
3-5 giorni
Stato di attività
Ferma
Chiarezza
Abbastanza chiara
Idoneità per principianti
35/100

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.