fix: validate EXEMPT_ECOSYSTEMS against supported package ecosystems#514
Merged
fix: validate EXEMPT_ECOSYSTEMS against supported package ecosystems#514
Conversation
Extract hardcoded ecosystem list into SUPPORTED_PACKAGE_ECOSYSTEMS constant and add validation to EXEMPT_ECOSYSTEMS parsing. A typo like 'docekr' instead of 'docker' now raises a ValueError with a clear message, consistent with how parse_repo_specific_exemptions already validates ecosystems. Closes #489 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…tions Add maven, gradle, and devcontainers to SUPPORTED_PACKAGE_ECOSYSTEMS - these are actively supported in dependabot_file.py but were missing from the validation list, which would have rejected valid configurations. Also add .lower() to parse_repo_specific_exemptions for consistent case-insensitive handling across both EXEMPT_ECOSYSTEMS and REPO_SPECIFIC_EXEMPTIONS. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Skip empty strings after split/strip instead of rejecting them as unrecognized ecosystems. A trailing comma (e.g. 'npm,docker,') was previously harmless and should remain so. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR tightens configuration validation by ensuring EXEMPT_ECOSYSTEMS values are checked against the same supported package ecosystem list used elsewhere, preventing typos from being silently ignored.
Changes:
- Introduces a module-level
SUPPORTED_PACKAGE_ECOSYSTEMSconstant and reuses it in ecosystem validation. - Validates
EXEMPT_ECOSYSTEMS, raising aValueErrorfor unrecognized ecosystems (and ignoring empty entries like trailing commas). - Adds tests covering unsupported ecosystems and trailing-comma tolerance for
EXEMPT_ECOSYSTEMS.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
env.py |
Adds SUPPORTED_PACKAGE_ECOSYSTEMS, reuses it in parse_repo_specific_exemptions, and validates EXEMPT_ECOSYSTEMS entries against it. |
test_env.py |
Adds regression tests for invalid EXEMPT_ECOSYSTEMS values and trailing comma handling. |
jmeridth
reviewed
Mar 26, 2026
Collaborator
jmeridth
left a comment
jmeridth
left a comment
There was a problem hiding this comment.
There were a few others mentioned in the documentation. Are we purposefully excluding them?
jmeridth
approved these changes
Mar 26, 2026
…ertion Update EXEMPT_ECOSYSTEMS docs to include devcontainers and gradle, add note about ValueError on unrecognized values, and alphabetize the list. Replace brittle result[21] index assertion in trailing comma test with full expected tuple comparison, matching the pattern used by all other tests in the file. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Fix MD060 table-column-style error caused by misaligned pipe character in the EXEMPT_ECOSYSTEMS row after updating the description text. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
EXEMPT_ECOSYSTEMSsilently accepts any string without validating against the list of supported package ecosystems. A typo likedocekrinstead ofdockerwould be ignored, leading to unexpected behavior where the ecosystem isn't actually exempted.Solution
parse_repo_specific_exemptionsinto a module-levelSUPPORTED_PACKAGE_ECOSYSTEMSconstant, eliminating duplicationEXEMPT_ECOSYSTEMSparsing logic that checks each ecosystem against the constantValueErrorwith a clear message identifying the unrecognized ecosystem, consistent with howparse_repo_specific_exemptionshandles invalid ecosystemsTesting
test_get_env_vars_exempt_ecosystems_unsupported_ecosystemtest case that verifies aValueErroris raised when an invalid ecosystem (e.g.,docekr) is providedCloses #489