forcedotcom / forcedotcom/code-analyzer
[BUG][code-analyzer] `sf code-analyzer run ...` causes Windows Defender to spike the CPU
- Lingua principale
- TypeScript
- Stelle
- 240
- Fork
- 52
- Merge medio
- 1g 23h
- PR unite (30g)
- 5
Descrizione
### Have you tried to resolve this issue yourself first?
Yes
### Bug Description
Any time that I run `sf code-analyzer run ...`, I almost immediately see a CPU spike, and `MsMpEng` is right alongside the host `node` process in CPU consumption:

The directory containing Salesforce projects is already in the exclusion list, and I don't see any issues running other `sf` commands from these projects. I'm guessing that something else being executed by Code Analyzer needs to be excluded, no? Any idea what that would be? I'm not comfortable excluding `node` altogether for what I hope are obvious reasons.
### Output / Logs
I also timed command execution with and without Defender active, and the impact is pretty significant:
**Defender enabled:** 2m6.395s
**Defender disabled:** 0m49.501s
### Steps To Reproduce
Run Code Analyzer on Windows with Defender enabled.
### Expected Behavior
There's some safe way to configure Windows Defender exclusions so that Code Analyzer can run without spiking the CPU.
### Operating System
Windows 11
### Salesforce CLI Version
@salesforce/cli/2.87.7 win32-arm64 node-v22.13.0
### Code Analyzer Plugin (@salesforce/sfdx-scanner) Version
code-analyzer 5.0.0 (5.0.0)
### Additional Context (Screenshots, Files, etc)
_No response_
### Workaround
_No response_
### Urgency
Low
Guida per i contributori
Apri la guida per i contributori
Direzione di ricerca
Start by reproducing `sf code-analyzer run ...` on Windows 11 with Defender enabled, using code-analyzer 5.0.0 and the reported CLI version, then compare CPU usage and timing with Defender disabled. Investigate which Code Analyzer processes or directories trigger Defender scanning. Done means documenting or implementing a safe exclusion configuration that avoids the spike without excluding Node globally.
Scritto dal modello di indicizzazione a partire dal testo della issue.
Valutazione
- Stack tecnologico
- nodejs, typescript
- Ambito
- devtools, operating-systems, performance
- Tipo di issue
- Bug
- Difficoltà
- 4/5
- Tempo stimato
- 3-5 giorni
- Stato di attività
- Ferma
- Chiarezza
- Abbastanza chiara
- Idoneità per principianti
- 35/100