fix(RELEASE-2685): treat empty cpe label as validation failure

src/tasks/managed/check_labels/check_labels.py

@@ -46,14 +46,16 @@ def derive_name_from_url(url: str) -> str:
 def get_label_value(component: dict[str, Any], label_name: str) -> str | None:
     """Extract a label value from a component's metadata labels list.
 
-    Return ``None`` when the label is absent or has no value.
+    Return ``None`` when the label key is absent from the metadata. Return
+    an empty string when the label is present but its value is empty or
+    whitespace-only, so callers can distinguish an unset label from one
+    that was set to an empty value.
     """
     labels = component.get("metadata", {}).get("labels") or []
     for label in labels:
         if label.get("name") == label_name:
             val = label.get("value")
-            if val is not None and str(val).strip():
-                return str(val)
+            return str(val).strip() if val is not None else ""
     return None
 
 
@@ -122,13 +124,23 @@ def _check_cpe_label(component: dict[str, Any], cpe_data: str, enforce: bool) ->
     comp_name = component["name"]
     cpe_label = get_label_value(component, "cpe")
 
-    if not cpe_label:
+    if cpe_label is None:
         logger.info(
             "Component '%s' is missing the 'cpe' label. Skipping enforcement.",
             comp_name,
         )
         return
 
+    if not cpe_label:
+        msg = (
+            f"Component '{comp_name}' 'cpe' label is set to an empty value. "
+            f"Expected the value '{cpe_data}'."
+        )
+        if enforce:
+            raise LabelValidationError(msg)
+        logger.warning(msg)
+        return
+
     if cpe_label != cpe_data:
         msg = (
             f"Component '{comp_name}' 'cpe' label ('{cpe_label}') does not "

src/tasks/managed/check_labels/tests/test_check_labels.py

@@ -108,6 +108,18 @@ def test_get_label_value_no_labels_key() -> None:
     assert check_labels.get_label_value(comp, "name") is None
 
 
+def test_get_label_value_present_but_empty() -> None:
+    """Return an empty string when the label is present with an empty value."""
+    comp = _make_component(labels=[_name_label("")])
+    assert check_labels.get_label_value(comp, "name") == ""
+
+
+def test_get_label_value_present_but_whitespace() -> None:
+    """Return an empty string when the label value is whitespace-only."""
+    comp = _make_component(labels=[_name_label("   ")])
+    assert check_labels.get_label_value(comp, "name") == ""
+
+
 # --- is_image_media_type ---
 
 
@@ -195,6 +207,59 @@ def test_no_cpe_label_skips(tmp_path: Path, caplog: pytest.LogCaptureFixture) ->
     assert "missing the 'cpe' label" in caplog.text
 
 
+def test_empty_cpe_label_enforce(tmp_path: Path) -> None:
+    """Fail when the CPE label is present but set to an empty string."""
+    snap = tmp_path / "snapshot.json"
+    data = tmp_path / "data.json"
+    _write_snapshot(
+        snap,
+        [
+            _make_component(
+                labels=[
+                    _name_label("openshift-gitops-1/gitops-rhel8-operator"),
+                    _cpe_label(""),
+                ],
+                repositories=[
+                    {
+                        "rh-registry-repo": "registry.redhat.io/openshift-gitops-1"
+                        "/gitops-rhel8-operator"
+                    }
+                ],
+            )
+        ],
+    )
+    _write_data(data)
+    with pytest.raises(check_labels.LabelValidationError, match="empty value"):
+        check_labels._check_labels(snap, data, enforce=True)
+
+
+def test_empty_cpe_label_warn(tmp_path: Path, caplog: pytest.LogCaptureFixture) -> None:
+    """Warn but succeed when the CPE label is empty and enforce is False."""
+    snap = tmp_path / "snapshot.json"
+    data = tmp_path / "data.json"
+    _write_snapshot(
+        snap,
+        [
+            _make_component(
+                labels=[
+                    _name_label("openshift-gitops-1/gitops-rhel8-operator"),
+                    _cpe_label(""),
+                ],
+                repositories=[
+                    {
+                        "rh-registry-repo": "registry.redhat.io/openshift-gitops-1"
+                        "/gitops-rhel8-operator"
+                    }
+                ],
+            )
+        ],
+    )
+    _write_data(data)
+    with caplog.at_level(logging.WARNING, logger="release"):
+        check_labels._check_labels(snap, data, enforce=False)
+    assert "'cpe' label is set to an empty value" in caplog.text
+
+
 # --- check_labels (name label failures) ---