Skip to content

Disable Windows Defender real-time scanning during Behat runs #267

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
schlessera merged 1 commit into from
Jul 21, 2026
Merged

Disable Windows Defender real-time scanning during Behat runs #267

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions .github/workflows/reusable-functional.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,16 @@ jobs:
WP_CLI_TEST_OBJECT_CACHE: ${{ inputs.object_cache }}

steps:
# The Behat suite spawns a large number of short-lived `wp`/`php`
# processes and writes many files per scenario. On the Windows runner,
# Defender's real-time scanning inspects each of these, which slows the
# run down by several times compared to Linux. Turning it off for the
# duration of this ephemeral job cuts the wall-clock time dramatically.
- name: Disable Windows Defender real-time scanning
if: ${{ startsWith(inputs.os, 'windows') }}
shell: pwsh
run: Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue
Comment on lines +54 to +62

@coderabbitai coderabbitai Bot Jul 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

git ls-files .github/workflows/reusable-functional.yml
wc -l .github/workflows/reusable-functional.yml
cat -n .github/workflows/reusable-functional.yml | sed -n '1,180p'

Repository: wp-cli/.github

Length of output: 8320

🏁 Script executed:

#!/bin/bash
set -euo pipefail

rg -n "Set-MpPreference|DisableRealtimeMonitoring|Defender|Add-MpPreference|ExclusionPath|ExclusionProcess" .github/workflows

Repository: wp-cli/.github

Length of output: 516

Avoid disabling Defender globally for the entire job.

This runs before checkout and dependency installation, so all later repo, Composer, and test code executes with real-time scanning off. Use a narrower workspace/process exclusion, or re-enable it in an always() cleanup step if this has to stay.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/reusable-functional.yml around lines 54 - 62, Update the
“Disable Windows Defender real-time scanning” workflow step to avoid leaving
Defender disabled across checkout, dependency installation, and tests. Prefer a
temporary workspace or process exclusion scoped to the Behat workload; if
disabling real-time monitoring remains necessary, add an always() cleanup step
that re-enables it before the job ends.

Comment on lines +59 to +62

@coderabbitai coderabbitai Bot Jul 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚀 Performance & Scalability | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== relevant snippet ==="
sed -n '1,140p' .github/workflows/reusable-functional.yml

echo
echo "=== search for Set-MpPreference and Defender mentions ==="
rg -n "Set-MpPreference|Defender|RealtimeMonitoring|ErrorAction SilentlyContinue" .github/workflows . -g '!**/node_modules/**' -g '!**/.git/**'

Repository: wp-cli/.github

Length of output: 6148

🏁 Script executed:

#!/bin/bash
set -euo pipefail

sed -n '1,140p' .github/workflows/reusable-functional.yml
printf '\n---\n'
rg -n "Set-MpPreference|Defender|RealtimeMonitoring|ErrorAction SilentlyContinue" .github/workflows . -g '!**/node_modules/**' -g '!**/.git/**'

Repository: wp-cli/.github

Length of output: 6069

🏁 Script executed:

#!/bin/bash
set -euo pipefail
sed -n '1,140p' .github/workflows/reusable-functional.yml
printf '\n---\n'
rg -n "Set-MpPreference|Defender|RealtimeMonitoring|ErrorAction SilentlyContinue" .github/workflows . -g '!**/node_modules/**' -g '!**/.git/**'

Repository: wp-cli/.github

Length of output: 6069

Surface Defender-disable failures -ErrorAction SilentlyContinue can leave Defender enabled while the job still passes. Use -ErrorAction Stop and emit a warning in catch so the optimization remains best-effort but observable.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/reusable-functional.yml around lines 59 - 62, Update the
“Disable Windows Defender real-time scanning” step to use PowerShell error
action Stop, wrap the Set-MpPreference invocation in catch handling, and emit a
warning when disabling fails. Preserve the Windows-only condition and
best-effort job continuation.


- name: Check out source code
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
Expand Down