[hermes] atlasbot: python:S2208 #139

New Issue

hermes-automation · 2026-09-26T13:26:51Z

hermes-automation commented

2026-09-26 13:26:51 +00:00

SonarQube reports python:S2208 in atlasbot/engine/answerer/spine.py. The build is green; this is a standing finding, not a failure.

What is wrong

Line 9 uses a wildcard import (from ._base import *), which hides which names actually enter the module namespace. Notably, no name from _base is referenced anywhere in this file's code — the star import only matters because the dynamically computed __all__ at the bottom of the file re-exports every underscore-prefixed name in globals(), so any underscore names that _base.__all__ exposes are silently re-exported through spine.

Ariadne opened no pull request for it: no automated patch was possible for this finding.

Facts

gitea — Import only needed names or import the module and then use its members. (CRITICAL, 5min estimated) (atlasbot/engine/answerer/spine.py:9)

Suggested fix (not applied)

Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch.

atlasbot/engine/answerer/spine.py — Replace the wildcard with an explicit import of exactly the names that _base.__all__ currently exports (those are the only names a star import binds when __all__ is defined; without an __all__, a star import skips underscore-prefixed names entirely, in which case the import is dead and should simply be deleted). Because the module's own __all__ is built from globals(), explicitly imported underscore names are still picked up and re-exported exactly as before, so behaviour is unchanged. The maintainer should substitute the real names from atlasbot/engine/answerer/_base.py's `all
... (truncated)

from atlasbot.engine.intent_router import IntentMatch
from atlasbot.snapshot.builder import summary_text

# List explicitly the names that _base.__all__ exports (the exact set the
# star import was binding). If _base has no __all__ containing underscore
# names, the old star import bound nothing this module uses or re-exports,
# and this import line can be removed entirely instead.
from ._base import (
    _name_one,
    _name_two,
)

Links

SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=atlasbot&open=AZ2y3T38Ky9i4pkIpSiV
Full evidence bundle and audit trail live in Ariadne at /api/admin/audit/events, event types hermes_autotriage_incident and hermes_autotriage_diagnosis.

Filed automatically by Ariadne from a Hermes Agent diagnosis (run run_1201d6d55fe142319007e8520b864423). Hermes has no write access to this repository; no files or infrastructure were changed.

SonarQube reports **python:S2208** in `atlasbot/engine/answerer/spine.py`. The build is green; this is a standing finding, not a failure. ## What is wrong Line 9 uses a wildcard import (`from ._base import *`), which hides which names actually enter the module namespace. Notably, no name from `_base` is referenced anywhere in this file's code — the star import only matters because the dynamically computed `__all__` at the bottom of the file re-exports every underscore-prefixed name in `globals()`, so any underscore names that `_base.__all__` exposes are silently re-exported through `spine`. Ariadne opened no pull request for it: no automated patch was possible for this finding. ## Facts - **gitea** — Import only needed names or import the module and then use its members. (CRITICAL, 5min estimated) (`atlasbot/engine/answerer/spine.py:9`) ## Suggested fix (not applied) Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch. **`atlasbot/engine/answerer/spine.py`** — Replace the wildcard with an explicit import of exactly the names that `_base.__all__` currently exports (those are the only names a star import binds when `__all__` is defined; without an `__all__`, a star import skips underscore-prefixed names entirely, in which case the import is dead and should simply be deleted). Because the module's own `__all__` is built from `globals()`, explicitly imported underscore names are still picked up and re-exported exactly as before, so behaviour is unchanged. The maintainer should substitute the real names from `atlasbot/engine/answerer/_base.py`'s `__all__ ... (truncated) ``` from atlasbot.engine.intent_router import IntentMatch from atlasbot.snapshot.builder import summary_text # List explicitly the names that _base.__all__ exports (the exact set the # star import was binding). If _base has no __all__ containing underscore # names, the old star import bound nothing this module uses or re-exports, # and this import line can be removed entirely instead. from ._base import ( _name_one, _name_two, ) ``` ## Links - SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=atlasbot&open=AZ2y3T38Ky9i4pkIpSiV - Full evidence bundle and audit trail live in Ariadne at `/api/admin/audit/events`, event types `hermes_autotriage_incident` and `hermes_autotriage_diagnosis`. Filed automatically by Ariadne from a Hermes Agent diagnosis (run [run_1201d6d55fe142319007e8520b864423](https://triage.bstein.dev/chat?resume=run_1201d6d55fe142319007e8520b864423)). Hermes has no write access to this repository; no files or infrastructure were changed.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: bstein/atlasbot#139