Manage scan profiles

Endor Labs often relies on specific versions of a runtime or package manager and requires build tools to scan your application. This ensures accurate software bill of materials (SBOM) and associated risk data for languages like Python, Java, or .NET where lock files are significantly less common.

Since software frequently relies on specific versions of a runtime or package manager, Endor Labs references the tools used in your software build process. You can define and install these build tools in CLI when they are not available in your environment. Endor Labs installs these tools in an isolated sandbox during the scan. The feature is currently supported for Linux and macOS operating systems.

A scan profile is a configuration that defines the parameters, toolchains, and projects for scanning operations. Scan profile is used to configure build toolchain and scan parameters required for a scan. Associate a project with a scan profile so that the scans for that project uses the configuration in the scan profile.

You need to install and initialize endorctl CLI, before configuring the build toolchains in a scan profile.

The following pages describe the various methods in which you can create a scan profile.

• Configure scan profile through the Endor Labs UI
• Configure scan profile through the Endor Labs API
• Configure scan profile through scanprofile.yaml file
• Automatically detect toolchains
• Uses system defaults

Configure build tools for Endor Labs GitHub App

Endor Labs GitHub App continuously monitors your projects for security and operational risks. The app monitors all the projects included in your GitHub workspace and scans run once every 24 hours. For performing scans, the GitHub App checks the toolchain specifications in the following order:

1. Toolchain configuration specified through endorctl API.
2. Toolchain configuration specified in scanprofile.yaml file.
3. Enable auto detection and automatically detect the toolchains from your manifest files.
4. Uses the system defaults.

Configure build tools in CLI

After installing and initializing the endorctl CLI, run the endorctl scan using the --install-build-tools command to dynamically download and install the required build tools.

1. For the first time, run the endorctl scan to create a project with Endor Labs.

endorctl scan

2. Run the following command to automatically download and install build tools as part of your scan.

endorctl scan --install-build-tools

3. The system checks for the required toolchain specifications in the following order before installing them in the sandbox.

   • Configure toolchain profile through endorctl API
   • Configure toolchain profile in the profile.yaml file
   • Automatically detect toolchain profiles
   • Uses the system defaults.

System default toolchain versions

If you do not provide a tool profile, the default toolchains are installed in the sandbox while performing the endorctl scan with the install-build-tools flag. See Toolchain reference for details on default versions.

Toolchain support matrix

The following table outlines the toolchain profile support details across different languages and platforms.

Configure automated scan parameters

Use automated scan parameters to configure endorctl parameters and environment variables for cloud scans. They can be used with projects linked to a scan profile and must be defined in the scan profile.

You can define the following parameters in your scan profile:

• included_paths: Enable to specify a list of paths to include in the scan.

• excluded_paths: Enable to specify a list of path to exclude from the scan.

• languages: Enable to specify a list of languages to scan. If empty, default values are used.

• call_graph_languages: Enable to specify a list of language to use for generating call graphs. If empty, default values are used.

• additional_environment_variables: Enable to specify additional environment variables to set during the scan. Only the environment variables starting with ENDOR_ are passed to the scan, all others are ignored.

• enable_automated_pr_scans: Enables automatic scanning of pull request changes.

• enable_pr_comments: Enables adding scan results as comments in pull requests.

• enable_sast_scan: Enables SAST during the scanning process.

• disable_code_snippet_storage: Disables the storage of code snippets.

If you are using Bazel in your build, you can further configure:

• bazel_configuration: Enable to specify configuration settings for Bazel scans. See Bazel flags for more details.

• bazel_show_internal_targets: Enable to include internal build targets in the dependency analysis.

• bazel_workspace_path: Enable to specify the path to the Bazel workspace.

• bazel_include_targets: Enable to specify Bazel targets to include in the scan.

• bazel_exclude_target: Enable to specify Bazel targets to exclude from the scan.

The following toolchain profile shows a yaml definition with configured automated scan parameters:

kind: AutomatedScanParameters
spec:
  automated_scan_parameters:
    included_paths:
      - python/**
    excluded_paths:
      - java/**
    languages:
      - python
    call_graph_languages:
      - python
    additional_environment_variables:
      - ENDOR_LOG_VERBOSE=true
      - ENDOR_LOG_LEVEL=debug
    enable_automated_pr_scans: true
    enable_pr_comments: true
    enable_sast_scan: true
    disable_code_snippet_storage: true
    bazel_configuration:
      bazel_show_internal_targets: true
      bazel_workspace_path: "go-bazel-repo/"
      bazel_include_targets:
      bazel_abs:
        - "//cmd:cmd"