Envar

Author: JosiahOne

.github/workflows/endor.yml

@@ -12,6 +12,8 @@ jobs:
       id-token: write # Used for keyless authentication with Endor Labs
       issues: write # Required to automatically comment on PRs for new policy violations
       pull-requests: write # Required to automatically comment on PRs for new policy violations
+    env:
+      ENDOR_SCAN_ENABLE_UV_PACKAGE_MANAGER: true
     runs-on: ubuntu-latest
     steps:
     - name: Checkout Repository
@@ -22,7 +24,7 @@ jobs:
       run: uv sync --locked --no-dev --no-editable
     - name: Endor Labs Scan Pull Request
       if: github.event_name == 'pull_request'
-      uses: endorlabs/github-action@v1.1.12
+      uses: endorlabs/github-action@v1.1.12 # Endor uses immutable releases so hash pinning not required
       with:
         namespace: "jellyfish" # Replace with your Endor Labs tenant namespace
         scan_dependencies: true
@@ -33,7 +35,7 @@ jobs:
         additional_args: "--exit-on-policy-warning"
     - name: Endor Labs Scan Push to main
       if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }}
-      uses: endorlabs/github-action@v1.1.12
+      uses: endorlabs/github-action@v1.1.12 # Endor uses immutable releases so hash pinning not required
       with:
         namespace: "jellyfish" # Replace with your Endor Labs tenant namespace
         scan_dependencies: true