From b958d492a8433c4fa302b4bb316fabab6feb122a Mon Sep 17 00:00:00 2001 From: bigboateng Date: Thu, 23 Jul 2026 21:59:06 +0100 Subject: [PATCH] ci: exclude Go caches from Defender on Windows test job The Windows test matrix spends ~10m almost entirely in Microsoft Defender real-time scanning of the small files the Go toolchain emits. Add a Windows-only step that excludes GOCACHE/GOMODCACHE/workspace and go.exe before setup-go, mirroring the upstream monorepo's shared go-setup action. --- .github/workflows/ci.yml | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4bd3204..c2f0578 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -48,6 +48,29 @@ jobs: else echo "go=false" >> "$GITHUB_OUTPUT" fi + # Windows `go test`/`go build` is dominated by Microsoft Defender scanning + # the many small files the Go toolchain emits during compile/link. Excluding + # the Go caches, the workspace, and go.exe is the single biggest wall-clock + # lever (this job dropped from ~10m to a couple of minutes upstream). + - name: Exclude Go caches from Microsoft Defender (Windows) + if: steps.runtime.outputs.go == 'true' && runner.os == 'Windows' + shell: pwsh + run: | + $targets = @( + "$env:LOCALAPPDATA\go-build", # GOCACHE (build cache) + "$env:USERPROFILE\go", # GOPATH incl. pkg\mod (GOMODCACHE) + $env:GITHUB_WORKSPACE, # sources + compiled test binaries + $env:RUNNER_TEMP + ) | Where-Object { $_ -and $_.Trim() -ne '' } | Select-Object -Unique + foreach ($t in $targets) { + try { + Add-MpPreference -ExclusionPath $t -ErrorAction Stop + Write-Host "Defender exclusion added: $t" + } catch { + Write-Host "::warning::Defender exclusion failed for $t : $($_.Exception.Message)" + } + } + try { Add-MpPreference -ExclusionProcess 'go.exe' -ErrorAction Stop } catch {} - uses: actions/setup-go@v5 if: steps.runtime.outputs.go == 'true' with: