[hermes] atlasbot: python:S2208 #149

New Issue

hermes-automation · 2026-09-28T08:23:10Z

hermes-automation commented

2026-09-28 08:23:10 +00:00

SonarQube reports python:S2208 in atlasbot/engine/answerer/spine.py. The build is green; this is a standing finding, not a failure.

What is wrong

Line 9 uses a wildcard import (from ._base import *), so it is impossible to tell from this file which names it pulls in; its only actual effect here is that the underscore-prefixed helpers exported by _base land in this module's globals and are silently re-exported by the dynamically computed all at the bottom of the file — spine.py's own code never references any _base name directly.

Ariadne opened no pull request for it: no automated patch was possible for this finding.

Facts

gitea — Import only needed names or import the module and then use its members. (CRITICAL, 5min estimated) (atlasbot/engine/answerer/spine.py:9)

Suggested fix (not applied)

Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch.

atlasbot/engine/answerer/spine.py — Replace the star import on line 9 with an explicit named import of every name that _base exports (star import honours _base.all, which — given the same dynamic-all pattern used in this file — is what lets underscore-prefixed names come through). Explicitly imported names are still bound in this module's namespace, so the dynamic all comprehension at the end of the file picks them up exactly as before and the re-export behaviour is unchanged; the only difference is that the import list is now visible and checkable. The placeholder names below must be replaced with the real contents
... (truncated)

from ._base import (
    _first_name_from_base_all,
    _second_name_from_base_all,
    # ...continue with one line per name listed in
    # atlasbot/engine/answerer/_base.__all__, in the same order
)

Links

SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=atlasbot&open=AZ2y3T38Ky9i4pkIpSiV
Full evidence bundle and audit trail live in Ariadne at /api/admin/audit/events, event types hermes_autotriage_incident and hermes_autotriage_diagnosis.

Filed automatically by Ariadne from a Hermes Agent diagnosis (run run_14643f90630e4334929985a7ebf69ca6). Hermes has no write access to this repository; no files or infrastructure were changed.

SonarQube reports **python:S2208** in `atlasbot/engine/answerer/spine.py`. The build is green; this is a standing finding, not a failure. ## What is wrong Line 9 uses a wildcard import (from ._base import *), so it is impossible to tell from this file which names it pulls in; its only actual effect here is that the underscore-prefixed helpers exported by _base land in this module's globals and are silently re-exported by the dynamically computed __all__ at the bottom of the file — spine.py's own code never references any _base name directly. Ariadne opened no pull request for it: no automated patch was possible for this finding. ## Facts - **gitea** — Import only needed names or import the module and then use its members. (CRITICAL, 5min estimated) (`atlasbot/engine/answerer/spine.py:9`) ## Suggested fix (not applied) Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch. **`atlasbot/engine/answerer/spine.py`** — Replace the star import on line 9 with an explicit named import of every name that _base exports (star import honours _base.__all__, which — given the same dynamic-__all__ pattern used in this file — is what lets underscore-prefixed names come through). Explicitly imported names are still bound in this module's namespace, so the dynamic __all__ comprehension at the end of the file picks them up exactly as before and the re-export behaviour is unchanged; the only difference is that the import list is now visible and checkable. The placeholder names below must be replaced with the real contents ... (truncated) ``` from ._base import ( _first_name_from_base_all, _second_name_from_base_all, # ...continue with one line per name listed in # atlasbot/engine/answerer/_base.__all__, in the same order ) ``` ## Links - SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=atlasbot&open=AZ2y3T38Ky9i4pkIpSiV - Full evidence bundle and audit trail live in Ariadne at `/api/admin/audit/events`, event types `hermes_autotriage_incident` and `hermes_autotriage_diagnosis`. Filed automatically by Ariadne from a Hermes Agent diagnosis (run [run_14643f90630e4334929985a7ebf69ca6](https://triage.bstein.dev/chat?resume=run_14643f90630e4334929985a7ebf69ca6)). Hermes has no write access to this repository; no files or infrastructure were changed.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: bstein/atlasbot#149