Skip to main content
Endor Labs uses build tools to scan projects, generate reliable Software Bill of Materials (SBOM), and detect security or operational risks. For languages like Java, Python, and .NET that depend on the build environment, it relies on specific runtime or package manager versions to ensure precise results. When tools are missing, you can define and install them in the CLI, and Endor Labs sets them up in an isolated sandbox during the scan. This feature is supported on Linux and macOS. You need to install and initialize endorctl before configuring the build toolchains in a scan profile.

​
Toolchain priority in GitHub App scans

Endor Labs GitHub App continuously monitors your projects for security and operational risks. The app monitors all the projects included in your GitHub workspace and scans run once every 24 hours. For performing scans, the GitHub App checks the toolchain specifications in the following order:
  1. Scan workflow, if present.
  2. Toolchain configuration specified through endorctl API.
  3. Toolchain configuration specified in scanprofile.yaml file.
  4. Enable auto detection to automatically detect the toolchains from your manifest files.
  5. Uses the system defaults.

​
Configure build tools for endorctl scans

After installing and initializing endorctl, run the endorctl scan with the --install-build-tools flag to automatically download and install any missing toolchains in an isolated sandbox to properly execute language-specific scans and dependency resolution.
  1. For the first time, run the endorctl scan to create a project with Endor Labs. 
    endorctl scan
  2. Run the following command to automatically download and install build tools as part of your scan. 
    endorctl scan --install-build-tools
  3. The system checks for the required toolchain specifications in the following order before installing them in the sandbox.

​
Scan with a preconfigured build environment

If your build tools are already installed in your scan environment, use --use-scan-profile to apply the project’s scan profile configuration without downloading and installing tools in a new sandbox. Endor Labs fetches the scan profile associated with the project and applies its automated scan parameters, including custom paths, environment variables, and any custom scripts, using the tools already available on the machine. This approach is useful when you have a container or CI runner with the required tools already installed and you want the scan profile to control scan behavior. Before you run the scan:
  1. Verify that the project already exists in Endor Labs. If it does not, run endorctl scan first to create it.
  2. Configure a scan profile for the project. See Configure scan profile through the Endor Labs user interface, through the API, or through a YAML file.
  3. Verify that the required build tools are installed on the machine.
To scan using the project’s scan profile, run: 
endorctl scan --use-scan-profile
--use-scan-profile and --install-build-tools cannot be used at the same time. Use --install-build-tools if you want to download and install build tools rather than using pre-installed ones.

​
System default toolchain versions

If you do not provide a tool profile, the default toolchains are installed in the sandbox while performing the endorctl scan with the install-build-tools flag. See Toolchain support matrix for details on default versions.

​
Toolchain support matrix

The following table outlines the toolchain profile support details across different languages and platforms.
.NET 5 and earlier versions are not supported for auto detection or manual configuration.
If a project uses Java 8, Endor Labs installs both Java 8 and Java 17.0.11. It builds the project with Java 8 and scans it with Java 17.

​
Configure automated scan parameters

Automated scan parameters are endorctl parameters and environment variables that you define in a scan profile. They apply to projects linked to that profile and help customize scan behavior during cloud scans. You can define the following parameters in your scan profile:
  • included_paths: Enable to specify a list of paths to include in the scan.
  • excluded_paths: Enable to specify a list of paths to exclude from the scan. Excluded paths do not apply to secrets scanning. Secrets detection always scans the full repository. To filter or suppress secret findings, use policies or a .gitleaksignore file instead.
  • languages: Enable to specify a list of languages to scan. If empty, default values are used.
  • call_graph_languages: Enable to specify a list of languages to use for generating call graphs. If empty, default values are used.
  • additional_environment_variables: Enable to specify additional environment variables to set during the scan. Only the environment variables starting with ENDOR_ are passed to the scan, all others are ignored. See Global flags and environment variables for a complete list of available environment variables.
  • enable_automated_pr_scans: Enables automatic scanning of pull request changes.
  • enable_pr_comments: Enables adding scan results as comments in pull requests.
  • enable_sast_scan: Enables SAST during the scanning process.
  • disable_code_snippet_storage: Disables the storage of code snippets.
If you are using Bazel in your build, you can further configure:
  • bazel_configuration: Enable to specify configuration settings for Bazel scans. See Bazel flags for more details.
  • bazel_show_internal_targets: Enable to include internal build targets in the dependency analysis.
  • bazel_workspace_path: Enable to specify the path to the Bazel workspace.
  • bazel_include_targets: Enable to specify Bazel targets to include in the scan.
  • bazel_exclude_target: Enable to specify Bazel targets to exclude from the scan.
The following toolchain profile shows a yaml definition with configured automated scan parameters: 
kind: AutomatedScanParameters
spec:
  automated_scan_parameters:
    included_paths:
      - python/**
    excluded_paths:
      - java/**
    languages:
      - python
    call_graph_languages:
      - python
    additional_environment_variables:
      - ENDOR_LOG_VERBOSE=true
      - ENDOR_LOG_LEVEL=debug
    enable_automated_pr_scans: true
    enable_pr_comments: true
    enable_sast_scan: true
    disable_code_snippet_storage: true
    bazel_configuration:
      bazel_show_internal_targets: true
      bazel_workspace_path: "go-bazel-repo/"
      bazel_include_targets:
      bazel_abs:
        - "//cmd:cmd"