[hermes] atlasbot: python:S2208 #147

New Issue

hermes-automation · 2026-09-28T03:25:37Z

hermes-automation commented

2026-09-28 03:25:37 +00:00

SonarQube reports python:S2208 in atlasbot/engine/answerer/spine.py. The build is green; this is a standing finding, not a failure.

What is wrong

Line 9 uses a wildcard import (from ._base import *), which hides which names this module actually depends on and pollutes its namespace. Notably, no _base member is referenced anywhere in spine.py itself, so the star import only has an effect if _base names are being re-exported through spine — its dynamic all at the bottom of the file sweeps up any underscore-prefixed names the star import happens to bring in.

Ariadne opened no pull request for it: no automated patch was possible for this finding.

Facts

gitea — Import only needed names or import the module and then use its members. (CRITICAL, 5min estimated) (atlasbot/engine/answerer/spine.py:9)

Suggested fix (not applied)

Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch.

atlasbot/engine/answerer/spine.py — Replace the wildcard on line 9 with an explicit import list. Copy the exact names from _base's all (or its public names if it defines no all), then keep only those that spine.py uses locally or that other modules import via spine (check with a grep for 'from atlasbot.engine.answerer.spine import' and 'from .spine import'). Since spine.py references no _base member directly, the list may well be empty — in that case delete line 9 outright. Listing the exact same names keeps spine's module globals, and therefore its computed all and any pass-through imports, identical to today, which
... (truncated)

from ._base import name_a, name_b  # replace name_a, name_b with the exact members _base exports that spine.py or its importers rely on; if that set is empty, remove this line entirely

Links

SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=atlasbot&open=AZ2y3T38Ky9i4pkIpSiV
Full evidence bundle and audit trail live in Ariadne at /api/admin/audit/events, event types hermes_autotriage_incident and hermes_autotriage_diagnosis.

Filed automatically by Ariadne from a Hermes Agent diagnosis (run run_bab8b7387d6b41cdb78394700631df7d). Hermes has no write access to this repository; no files or infrastructure were changed.

SonarQube reports **python:S2208** in `atlasbot/engine/answerer/spine.py`. The build is green; this is a standing finding, not a failure. ## What is wrong Line 9 uses a wildcard import (from ._base import *), which hides which names this module actually depends on and pollutes its namespace. Notably, no _base member is referenced anywhere in spine.py itself, so the star import only has an effect if _base names are being re-exported through spine — its dynamic __all__ at the bottom of the file sweeps up any underscore-prefixed names the star import happens to bring in. Ariadne opened no pull request for it: no automated patch was possible for this finding. ## Facts - **gitea** — Import only needed names or import the module and then use its members. (CRITICAL, 5min estimated) (`atlasbot/engine/answerer/spine.py:9`) ## Suggested fix (not applied) Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch. **`atlasbot/engine/answerer/spine.py`** — Replace the wildcard on line 9 with an explicit import list. Copy the exact names from _base's __all__ (or its public names if it defines no __all__), then keep only those that spine.py uses locally or that other modules import via spine (check with a grep for 'from atlasbot.engine.answerer.spine import' and 'from .spine import'). Since spine.py references no _base member directly, the list may well be empty — in that case delete line 9 outright. Listing the exact same names keeps spine's module globals, and therefore its computed __all__ and any pass-through imports, identical to today, which ... (truncated) ``` from ._base import name_a, name_b # replace name_a, name_b with the exact members _base exports that spine.py or its importers rely on; if that set is empty, remove this line entirely ``` ## Links - SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=atlasbot&open=AZ2y3T38Ky9i4pkIpSiV - Full evidence bundle and audit trail live in Ariadne at `/api/admin/audit/events`, event types `hermes_autotriage_incident` and `hermes_autotriage_diagnosis`. Filed automatically by Ariadne from a Hermes Agent diagnosis (run [run_bab8b7387d6b41cdb78394700631df7d](https://triage.bstein.dev/chat?resume=run_bab8b7387d6b41cdb78394700631df7d)). Hermes has no write access to this repository; no files or infrastructure were changed.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: bstein/atlasbot#147