feat: expose python_pipenv_enabled for Pipfile scans

README.md

@@ -166,6 +166,7 @@ The following input parameters are also supported for the Endor Labs GitHub acti
 | `pr_baseline` | Set to the git reference that you are merging to, such as the default branch. Enables endorctl to compare findings so developers are only alerted to issues un the current changeset. Example: `pr_baseline: "main"`. Note: Not needed if `enable_pr_comments` is set to `true`. |
 | `pr_incremental` | Set to `true` to only scan files, or packages with dependencies that have changed compared to the baseline scan. (Default: `false`) |
 | `pr` | Set to `false` to track this scan as a monitored version within Endor Labs, as opposed to a point in time policy and finding test for a PR. (Default: `true`) |
+| `python_pipenv_enabled` | Set to `true` to enable Pipenv dependency resolution for `Pipfile` / `Pipfile.lock` projects (exports `ENDOR_PYTHON_PIPENV_ENABLED=true`). Requires `pipenv` on the runner PATH. (Default: `false`) |
 | `project_name` | Specify a project name for a container image scan or for a package scan. |
 | `run_stats` | Set to `false` to disable reporting of CPU/RAM/time scan statistics via `time -v` (may be required on Windows runners). (Default: `true`) |
 | `sarif_file` | Set to a location on your GitHub runner to output the findings in SARIF format. |
@@ -189,6 +190,7 @@ The following environmental variables are potentially relevant for the Endor Lab
 | Environmental Variable | Description |
 | :-- | :-- |
 | `ENDOR_JS_ENABLE_TSSERVER` | Set to `false` to avoid installing tsserver when JavaScript/TypeScript call graphs are not needed. |
+| `ENDOR_PYTHON_PIPENV_ENABLED` | Set by the action when `python_pipenv_enabled` is `true`, so endorctl resolves Pipenv projects. |
 
 ### Artifact Signing parameters
 

action.yml

@@ -220,6 +220,13 @@ inputs:
     default: false
     description: >-
       "Enable phantom dependency analysis to identify dependencies used, but not declared in the manifest file."
+  # Enable Pipenv dependency resolution (exports ENDOR_PYTHON_PIPENV_ENABLED).
+  python_pipenv_enabled:
+    default: false
+    description: >-
+      "Enable Pipenv dependency resolution for Pipfile / Pipfile.lock projects by
+      exporting `ENDOR_PYTHON_PIPENV_ENABLED=true` for endorctl. Requires `pipenv`
+      on the runner PATH."
   disable_code_snippet_storage:
     description: >-
       "Do not store or display the source code related to a finding."

dist/index.js

@@ -98393,6 +98393,7 @@ function get_scan_options(options) {
     const BAZEL_EXCLUDE_TARGETS = core.getInput("bazel_exclude_targets");
     const BAZEL_INCLUDE_TARGETS = core.getInput("bazel_include_targets");
     const BAZEL_TARGETS_QUERY = core.getInput("bazel_targets_query");
+    const PYTHON_PIPENV_ENABLED = core.getBooleanInput("python_pipenv_enabled");
     if (!SCAN_DEPENDENCIES &&
         !SCAN_SECRETS &&
         !SCAN_SAST &&
@@ -98495,6 +98496,11 @@ function get_scan_options(options) {
             options.push(`--bazel-targets-query=${BAZEL_TARGETS_QUERY}`);
         }
     }
+    // python_pipenv_enabled → ENDOR_PYTHON_PIPENV_ENABLED (in-flight endorctl env).
+    // Leave ambient ENDOR_PYTHON_PIPENV_ENABLED alone when the input is false.
+    if (PYTHON_PIPENV_ENABLED) {
+        core.exportVariable("ENDOR_PYTHON_PIPENV_ENABLED", "true");
+    }
     if (SCAN_GIT_LOGS) {
         if (!SCAN_SECRETS) {
             core.error("Please also enable `scan_secrets` to scan Git logs for secrets");

src/scan.ts

@@ -50,6 +50,7 @@ function get_scan_options(options: string[]): void {
   const BAZEL_EXCLUDE_TARGETS = core.getInput("bazel_exclude_targets");
   const BAZEL_INCLUDE_TARGETS = core.getInput("bazel_include_targets");
   const BAZEL_TARGETS_QUERY = core.getInput("bazel_targets_query");
+  const PYTHON_PIPENV_ENABLED = core.getBooleanInput("python_pipenv_enabled");
 
   if (
     !SCAN_DEPENDENCIES &&
@@ -181,6 +182,12 @@ function get_scan_options(options: string[]): void {
     }
   }
 
+  // python_pipenv_enabled → ENDOR_PYTHON_PIPENV_ENABLED (in-flight endorctl env).
+  // Leave ambient ENDOR_PYTHON_PIPENV_ENABLED alone when the input is false.
+  if (PYTHON_PIPENV_ENABLED) {
+    core.exportVariable("ENDOR_PYTHON_PIPENV_ENABLED", "true");
+  }
+
   if (SCAN_GIT_LOGS) {
     if (!SCAN_SECRETS) {
       core.error(