slachiewicz opened a new pull request, #306: URL: https://github.com/apache/maven-gh-actions-shared/pull/306
Windows jobs are the wall-clock tail of essentially every matrix this workflow runs, and the gap against Linux is far larger than the hardware difference explains. Measured on `apache/maven-dependency-plugin` ([run 31332965451](https://github.com/apache/maven-dependency-plugin/actions/runs/31332965451), same commit, same 99 invoker ITs): | | job | of which ITs | per IT | |---|---|---|---| | `ubuntu-latest` jdk-17 / 3.10.0-rc-1 | 6m58s | 4m43s | 2.9s | | `windows-latest` jdk-21 / 4.0.0-rc-6 | 14m23s | 11m34s | 7.0s | A Maven build is close to a worst case for a real-time virus scanner. It writes and re-reads tens of thousands of small files, and forks a fresh JVM per module and per integration test that reads its whole classpath back off disk. Defender inspects every one of those reads synchronously. This excludes the workspace, the local repository and the runner temp directory, plus the JDK executables, from the real-time scanner. The runners are ephemeral and only ever build the code they just checked out, so the scan buys nothing here — this is emphatically not something to do on a durable machine. Behind a new `windows-defender-exclusions` input, on by default, a no-op on every non-Windows runner. If the cmdlets are missing or fail, the step logs a warning and the build carries on. ### Why inlined instead of a composite action next to `install-svn` A composite action in this repo has to be referenced as `apache/maven-gh-actions-shared/.github/actions/<name>@v5`, so it cannot be exercised on the branch that introduces it. Worse, the runner resolves every `uses:` during *Set up job*, before any `if:` is evaluated — I tried the composite form first and it failed the **Linux** jobs with `Can't find 'action.yml' ... @v5`, not just the Windows ones. Two ~15-line `pwsh` blocks seemed the lesser evil, but happy to switch if you'd rather take that on merge. ### Numbers A/B benchmark pending — two arms × two repetitions on `windows-latest`, both building the same `maven-dependency-plugin` commit, identical but for this step. I'll post the result here before taking this out of draft. --- <sub>Drafted with Claude — please verify</sub> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
