Problem
CI adds Windows Defender exclusions for broad workspace and package-cache paths. That improves test stability/performance but expands the unscanned area during workflow execution.
Evidence
.github/workflows/dotnet.yml and .github/workflows/release.yml build exclusion candidates including:
${{ github.workspace }}$env:RUNNER_TEMP, $env:TEMP, $env:TMP, GetTempPath()$env:NUGET_PACKAGES, user NuGet cache paths
Expected behavior
Narrow the exclusion list to the minimum paths needed for test performance, or emit an explicit audit record explaining the exact exclusions and why they are required.
Labels
enhancement, security, github_actions
Problem
CI adds Windows Defender exclusions for broad workspace and package-cache paths. That improves test stability/performance but expands the unscanned area during workflow execution.
Evidence
.github/workflows/dotnet.ymland.github/workflows/release.ymlbuild exclusion candidates including:${{ github.workspace }}$env:RUNNER_TEMP,$env:TEMP,$env:TMP,GetTempPath()$env:NUGET_PACKAGES, user NuGet cache pathsExpected behavior
Narrow the exclusion list to the minimum paths needed for test performance, or emit an explicit audit record explaining the exact exclusions and why they are required.
Labels
enhancement,security,github_actions