[EltonChang1]

Description

Add an opt-in --isolated flag to cyclonedx-py environment. When it is set, the interpreter path probe does not inherit PYTHONPATH, PYTHONHOME, or VIRTUAL_ENV, including mixed-case names on Windows. A parent process can no longer inject packages into an SBOM for a target environment. The flag is off by default, so workflows that intentionally pass those variables keep the current behavior.

The probe builds a fresh environment mapping and drops those names case-insensitively, because os.environ.copy() is case-sensitive even where Windows environment lookup is not. With no interpreter argument, --isolated probes the current executable under that same cleaned environment instead of reusing the already-imported sys.path.

Resolves or fixes issue: #1045

AI Tool Disclosure

• My contribution does not include any AI-generated content
• My contribution includes AI-generated content, as disclosed below:
  • AI Tools: Cursor coding agent
  • LLMs and versions: Grok 4.7
  • Prompts: Implement the maintainer-requested --isolated flag from issue 1045. Drop PYTHONPATH, PYTHONHOME, and VIRTUAL_ENV only when the flag is set, keep the default inheritance behavior, and add regression tests plus the environment help text.

Affirmation

• My code follows the CONTRIBUTING.md guidelines

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 6 complexity · 0 duplication

Metric	Results
Complexity	✅ 6 (≤ 20 complexity)
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[read-the-docs-community]

Documentation build overview

📚 CycloneDX Python SBOM Tool | 🛠️ Build #35203841 | 📁 Comparing ca0272f against latest (fc11987)

  🔍 Preview build  

1 file changed

± usage.html

[jkowalleck]

we already have a pending implementation for : #1045
see #1106

what makes this one different?

[juliosuas]

Thanks for the approval, @jkowalleck! I went through #1123 and left a review there. In short, I proposed that we keep -E from this PR, because it lets the interpreter ignore every PYTHON* variable without a hand-maintained list, and that we take Elton's good idea of also probing sys.executable when no target python is given. That would be a small follow-up, credited to him, unless you'd prefer it here. I'm waiting to hear back from him.

CI: I pushed a commit that fixes the lint failure (the new test name tripped flake8 N802). The macOS py3.11–3.14 failures look unrelated: pipenv's testbed init picks up Homebrew's Python 3.15 and crashes in typing_extensions (typing.no_type_check_decorator is gone). Recent main runs fail the same four macOS jobs.

[juliosuas]

@EltonChang1 following up on my note above, here's the actual review of #1123:

• The casefold handling is careful, but I don't think the probe needs it. CPython reads its own PYTHON* variables at startup, so python -E skips PythonPath/PYTHONPATH whatever the casing, on Windows too. -E also covers the other variables that change sys.path (PYTHONSAFEPATH, PYTHONUSERBASE, PYTHONPLATLIBDIR, ...), and a fixed list of three names would have to keep growing to match.
• VIRTUAL_ENV: as far as I know the interpreter doesn't look at it when it builds sys.path (venvs come from pyvenv.cfg), so dropping it shouldn't change the probe.
• Running the probe on sys.executable when no <python> is given is a good idea. feat(environment): add option -E to ignore parent PYTHON* env vars #1106 doesn't cover that right now.
• Both approaches share the same risk: an interpreter that needs PYTHONHOME to start will fail. Your test for that case is a nice one.

Since @jkowalleck already approved #1106, my proposal is to land #1106 and then add your no-target handling as a small follow-up (or as a commit on #1106, with you as co-author, whichever you like). How does that sound?