Skip to content

EXEMPT_ECOSYSTEMS accepts invalid ecosystem names without validation #489

@zkoppert

Description

@zkoppert

Bug

EXEMPT_ECOSYSTEMS does not validate its values against the list of supported package ecosystems. Any string is silently accepted, so a typo like "docekr" instead of "docker" would be ignored without error, leading to unexpected behavior (the ecosystem wouldn't actually be exempted).

Expected behavior

EXEMPT_ECOSYSTEMS should validate each ecosystem against the same allowed list used by REPO_SPECIFIC_EXEMPTIONS:

bundler, cargo, composer, docker, github-actions, gomod, mix, npm, nuget, pip, terraform

An unrecognized value should raise a ValueError, consistent with how parse_repo_specific_exemptions handles invalid ecosystems.

Current behavior

https://github.com/github-community-projects/evergreen/blob/main/env.py#L241-L245

exempt_ecosystems_list = [
    ecosystem.lower().strip() for ecosystem in exempt_ecosystems.split(",")
]

Values are lowercased and stripped, but never checked against the supported ecosystem list.

Additional context

Discovered while reviewing PR #488, which fixed a related whitespace-trimming bug in REPO_SPECIFIC_EXEMPTIONS. That parser validates ecosystems; this one does not.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions