[juliosuas]

Description

Fixes #1045.

cyclonedx-py environment <python> discovers the target interpreter's sys.path via a subprocess. That subprocess previously honored parent PYTHON* variables (notably PYTHONPATH), so packages visible only to the caller could appear in the SBOM as if installed in the scanned environment.

Maintainers confirmed that inheriting the parent environment is intentional for some workflows and asked for an opt-in flag rather than changing the default.

This change adds -E, which probes the target interpreter with python -E (same insertion pattern as existing -S) so PYTHON* variables are ignored by the documented interpreter mechanism. Default behavior is unchanged. The flag only applies when a target <python> is given.

Regression covered by TestCliEnvironment.test_E_ignores_parent_pythonpath.

Resolves or fixes issue: #1045

AI Tool Disclosure

• My contribution does not include any AI-generated content
• My contribution includes AI-generated content, as disclosed below:
  • AI Tools: [Cursor agent]
  • LLMs and versions: [Cursor agent (model not recorded); drafting only; every line human-reviewed]
  • Prompts: [Implement opt-in --isolated for environment path detection per issue #1045 and maintainer guidance (use python -E; keep default inheritance; add regression test and docs); human-reviewed before opening]

Affirmation

• My code follows the CONTRIBUTING.md guidelines

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	✅ 0 (≤ 20 complexity)
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[read-the-docs-community]

Documentation build overview

📚 CycloneDX Python SBOM Tool | 🛠️ Build #35275029 | 📁 Comparing b73c19b against latest (f6f4941)

  🔍 Preview build  

2 files changed

± changelog.html
± usage.html

[jkowalleck]

i think the option --isolated is a bit misleading - while i see that the idea might stem from pip --isolated, we dont run in a pip-like mode.

lets better go with -E that clearly shows that is stems from python -E - - just like we already have a -S option.

[juliosuas]

Done in c37f2cb: renamed to -E (mirrors python -E, alongside the existing -S). Docs and test updated, title and description adjusted.

[jkowalleck]

there popped up an alternative implementation for this feature:
#1123

Originally, I planned to merge this one this week, since no new things popped up here.
Now there is this other thing, which caused me to postpone the planned merge by a week.

I tend to prefer this #1106 over the other/newer one.
mostly for the time investment in this one already, and its maturity.

@juliosuas , @EltonChang1 ,
Could you please review each others PR's and see if this one here is a suitable implementation you can agree on?

[juliosuas]

Thanks for the approval, @jkowalleck! I reviewed #1123 and left my notes there, proposing we land this one and add Elton's no-target idea as a credited follow-up. Lint is fixed in b73c19b; the macOS failures match the current main runs.