[hermes] atlasbot: python:S2208 #158

New Issue

hermes-automation · 2026-09-29T14:25:51Z

hermes-automation commented

2026-09-29 14:25:51 +00:00

SonarQube reports python:S2208 in atlasbot/engine/answerer/spine.py. The build is green; this is a standing finding, not a failure.

What is wrong

Line 9 uses a wildcard import (from ._base import *) even though no name from _base is referenced anywhere in spine.py. The wildcard exists only so the globals()-based __all__ at the bottom of the file re-exports _base's underscore-prefixed helpers, which hides the module's real dependency surface and is exactly what python:S2208 flags.

Ariadne opened no pull request for it: no automated patch was possible for this finding.

Facts

gitea — Import only needed names or import the module and then use its members. (CRITICAL, 5min estimated) (atlasbot/engine/answerer/spine.py:9)

Suggested fix (not applied)

Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch.

atlasbot/engine/answerer/spine.py — Replace the wildcard with an explicit import list naming every member _base currently exports (the names in _base.__all__, since star-import only pulls underscore-prefixed names when _base declares them there). Explicitly imported names still land in this module's globals(), so the __all__ comprehension at the bottom of spine.py continues to re-export them and downstream from .spine import * consumers see the identical set of names — behaviour is unchanged, but the dependency on _base becomes visible and lintable. The names below are placeholders: copy the actual list from `_base
... (truncated)

from ._base import (
    _base_helper_one,
    _base_helper_two,
    # ...one line per name in atlasbot/engine/answerer/_base.__all__;
    # keep the list complete so the globals()-derived __all__ below
    # re-exports exactly the same names as before
)

Links

SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=atlasbot&open=AZ2y3T38Ky9i4pkIpSiV
Full evidence bundle and audit trail live in Ariadne at /api/admin/audit/events, event types hermes_autotriage_incident and hermes_autotriage_diagnosis.

Filed automatically by Ariadne from a Hermes Agent diagnosis (run run_07df0bb29b294d82aaf5fb139b391c9c). Hermes has no write access to this repository; no files or infrastructure were changed.

SonarQube reports **python:S2208** in `atlasbot/engine/answerer/spine.py`. The build is green; this is a standing finding, not a failure. ## What is wrong Line 9 uses a wildcard import (`from ._base import *`) even though no name from `_base` is referenced anywhere in spine.py. The wildcard exists only so the `globals()`-based `__all__` at the bottom of the file re-exports `_base`'s underscore-prefixed helpers, which hides the module's real dependency surface and is exactly what python:S2208 flags. Ariadne opened no pull request for it: no automated patch was possible for this finding. ## Facts - **gitea** — Import only needed names or import the module and then use its members. (CRITICAL, 5min estimated) (`atlasbot/engine/answerer/spine.py:9`) ## Suggested fix (not applied) Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch. **`atlasbot/engine/answerer/spine.py`** — Replace the wildcard with an explicit import list naming every member `_base` currently exports (the names in `_base.__all__`, since star-import only pulls underscore-prefixed names when `_base` declares them there). Explicitly imported names still land in this module's `globals()`, so the `__all__` comprehension at the bottom of spine.py continues to re-export them and downstream `from .spine import *` consumers see the identical set of names — behaviour is unchanged, but the dependency on `_base` becomes visible and lintable. The names below are placeholders: copy the actual list from `_base ... (truncated) ``` from ._base import ( _base_helper_one, _base_helper_two, # ...one line per name in atlasbot/engine/answerer/_base.__all__; # keep the list complete so the globals()-derived __all__ below # re-exports exactly the same names as before ) ``` ## Links - SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=atlasbot&open=AZ2y3T38Ky9i4pkIpSiV - Full evidence bundle and audit trail live in Ariadne at `/api/admin/audit/events`, event types `hermes_autotriage_incident` and `hermes_autotriage_diagnosis`. Filed automatically by Ariadne from a Hermes Agent diagnosis (run [run_07df0bb29b294d82aaf5fb139b391c9c](https://triage.bstein.dev/chat?resume=run_07df0bb29b294d82aaf5fb139b391c9c)). Hermes has no write access to this repository; no files or infrastructure were changed.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: bstein/atlasbot#158