How do I scan code or artifacts that are not in a Git repository?

Last updated: June 12, 2026

Context

Customers working in non-Git environments (e.g., Databricks, Perforce, SVN, or any platform where code and artifacts are not tracked in a Git repository) may need to scan their code or packaged artifacts for dependency vulnerabilities using Endor Labs.

The challenge is that endorctl requires a Git repository with a remote origin to initialize a project. This means that artifacts, folders, or codebases that don't live in a Git repo cannot be scanned out of the box using the standard filesystem scan.

Why not use the binary artifact scan? The --package flag supports scanning pre-built packages, but it is designed for recognized package formats (e.g., Java JARs, Python wheels). If your artifact doesn't follow one of these standard formats, the scanner may not detect the dependencies inside. In those cases, the workaround below is the recommended approach.

Answer

The recommended approach is to create a synthetic Git repository around the artifact contents so endorctl can scan them normally. This is a stable, supported workaround used by several customers.

Step-by-step resolution

  1. Prepare a working directory with the code or artifacts you want to scan. If you already have a folder ready, cd into it. If your artifacts are packaged as an archive, extract them first:

   mkdir -p /tmp/scan-workdir && cd /tmp/scan-workdir
   tar -xzf /path/to/your-artifact.tar.gz

  1. Initialize a Git repository in the directory:

   git init
   git add .   
   git commit -m "artifact scan"

  1. Add a synthetic remote origin. This determines the project name that appears in the Endor Labs portal and is also used to identify the existing Project on subsequent scans. A subsequent scan using the same remote origin URL will update the existing Project rather than create a duplicate. The repository does not need to actually exist:

   git remote add origin https://github.com/<your-org>/<project-name>.git

  1. Run the scan:

   endorctl scan \  
    --namespace <YOUR_NAMESPACE> \ 
    --api-key <CLIENT_ID> \   
    --api-secret <CLIENT_SECRET>

  1. Use the exit code to gate downstream workflows:

    • Exit code

      Meaning

      0

      Scan completed successfully. No policy violations, OR only warning-level policies were triggered (without --exit-on-policy-warning).

      128

      A "break the build" action policy was triggered.

      129

      A warning-level action policy was triggered and --exit-on-policy-warning was set.

      Other non-zero

      A scan error occurred (e.g., authentication failure, misconfiguration). Not a policy result.

    • For the full exit code reference, see endorctl CLI exit codes.

  2. Clean up the temporary directory after scanning:

   rm -rf /tmp/scan-workdir

Reusable script

A reusable shell script that automates this entire workflow (including auto-installing git and endorctl if missing) is available here:

scan-artifact-no-git

The script handles extraction, synthetic repo setup, scanning, exit code propagation, and cleanup. It accepts both .tar.gz files and folders, and supports configuration via CLI arguments or environment variables. It also includes a GitHub Actions workflow and a sample model artifact for testing.

Key details

  • Dynamic project naming: Each unique remote origin URL creates a separate project in the Endor Labs portal. For environments where artifacts arrive dynamically (e.g., ML pipelines), the project name can be derived from the artifact filename or model name.

  • Git availability: If git is not present on the environment (e.g., Databricks clusters), it can be installed via a cluster init script (apt-get install -y git) or will be auto-installed by the reusable script above.

  • Applicable beyond ML: This approach works for any codebase or artifact set not tracked in Git — including Perforce projects, SVN repositories, or vendor-provided source packages.

Sources