From bb2c2df4690881a7c14b6cb8b303a7777e8c1595 Mon Sep 17 00:00:00 2001
From: Yury Zialionka <yzialionka@anaconda.com>
Date: Thu, 13 Aug 2026 18:12:36 -0600
Subject: [PATCH] perf(ci): exclude runner work dirs from Defender scanning on
 Windows

Real-time scanning taxes every process spawn and temp-file write; the
unit suite spawns hundreds of test processes and creates temp git repos.
Excluding the workspace, temp dirs, and bun cache cuts that overhead.
Best effort: on images where Defender is absent or locked down the step
logs and the suite runs unchanged.
---
 .github/workflows/test.yml | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index a67718ec17..ddf106b237 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -90,6 +90,25 @@ jobs:
         run: echo "Only isolated product, documentation, or metadata files changed; general unit tests are unchanged."
       # kilocode_change end
 
+      # kilocode_change start - Defender real-time scanning taxes every process spawn and
+      # temp-file write on Windows; the suite spawns hundreds of test processes and builds
+      # temp git repos, so exclude the runner's work and temp paths up front. Best effort by
+      # design: on images where Defender is absent or locked down, the suite runs unchanged.
+      - name: Exclude runner work dirs from Defender scanning
+        if: matrix.settings.run && runner.os == 'Windows'
+        continue-on-error: true
+        shell: pwsh
+        run: |
+          try {
+            foreach ($dir in @($env:GITHUB_WORKSPACE, $env:RUNNER_TEMP, $env:TEMP, "$env:USERPROFILE\.bun")) {
+              if ($dir) { Add-MpPreference -ExclusionPath $dir -ErrorAction Stop }
+            }
+            Write-Host "Defender path exclusions applied."
+          } catch {
+            Write-Host "Defender exclusions not applied: $($_.Exception.Message)"
+          }
+      # kilocode_change end
+
       - name: Checkout repository
         if: matrix.settings.run # kilocode_change
         uses: actions/checkout@v6 # kilocode_change