[hermes] bstein_home: python:S2208 #141

New Issue

hermes-automation · 2026-09-23T06:29:24Z

hermes-automation commented

2026-09-23 06:29:24 +00:00

SonarQube reports python:S2208 in backend/atlas_portal/routes/access_requests.py. The build is green; this is a standing finding, not a failure.

What is wrong

The wildcard import obscures which names access_request_state exposes through this facade. Those names must remain bound on the facade itself because register() passes that module as deps and callers may patch its attributes; simply passing the state module instead would change behavior.

Ariadne opened no pull request for it: no automated patch was possible for this finding.

Facts

gitea — Import only needed names or import the module and then use its members. (CRITICAL, 5min estimated) (backend/atlas_portal/routes/access_requests.py:8)

Suggested fix (not applied)

Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch.

backend/atlas_portal/routes/access_requests.py — Replace the wildcard import with explicit imports of exactly the names it currently exports, preserving aliases and the existing register() implementation. The state module was not supplied, so its export names cannot safely be invented. The following maintainer helper prints the proposed complete file without writing it; run it from the repository root in the backend's configured Python environment, review the generated imports against access_request_state.all (or its public names when all is absent), then make the edit by hand. This preserves the facade's existing patch surface rathe
... (truncated)

from importlib import import_module
from pathlib import Path
import sys

sys.path.insert(0, str(Path('backend').resolve()))
state = import_module('atlas_portal.routes.access_request_state')
exports = getattr(state, '__all__', None)
if exports is None:
    exports = [name for name in vars(state) if not name.startswith('_')]
exports = list(exports)

import keyword
if any(not isinstance(name, str) or not name.isidentifier() or keyword.iskeyword(name) for name in exports):
    raise ValueError('Exports require manual review before generating explicit imports')

path = Path('backend/atlas_portal/routes/access_requests.py')
source = path.read_text()
old = 'from .access_request_state import *  # noqa: F403 - facade preserves existing patch surface'
if source.count(old) != 1:
    raise ValueError('Expected exactly one matching wildcard import')
if exports:
    replacement = 'from .access_request_state import (\n' + ''.join(
        f'    {name} as {name},\n' for name in exports
    ) + ')'
else:
    raise ValueError('No exports; review module initialization requirements manually')
print(source.replace(old, replacement), end='')

Links

SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=bstein_home&open=AZ2y3BYyKy9i4pkIpR-L
Full evidence bundle and audit trail live in Ariadne at /api/admin/audit/events, event types hermes_autotriage_incident and hermes_autotriage_diagnosis.

Filed automatically by Ariadne from a Hermes Agent diagnosis (run run_453e4c49d31d4aae9e77f0bd94078817). Hermes has no write access to this repository; no files or infrastructure were changed.

SonarQube reports **python:S2208** in `backend/atlas_portal/routes/access_requests.py`. The build is green; this is a standing finding, not a failure. ## What is wrong The wildcard import obscures which names access_request_state exposes through this facade. Those names must remain bound on the facade itself because register() passes that module as deps and callers may patch its attributes; simply passing the state module instead would change behavior. Ariadne opened no pull request for it: no automated patch was possible for this finding. ## Facts - **gitea** — Import only needed names or import the module and then use its members. (CRITICAL, 5min estimated) (`backend/atlas_portal/routes/access_requests.py:8`) ## Suggested fix (not applied) Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch. **`backend/atlas_portal/routes/access_requests.py`** — Replace the wildcard import with explicit imports of exactly the names it currently exports, preserving aliases and the existing register() implementation. The state module was not supplied, so its export names cannot safely be invented. The following maintainer helper prints the proposed complete file without writing it; run it from the repository root in the backend's configured Python environment, review the generated imports against access_request_state.__all__ (or its public names when __all__ is absent), then make the edit by hand. This preserves the facade's existing patch surface rathe ... (truncated) ``` from importlib import import_module from pathlib import Path import sys sys.path.insert(0, str(Path('backend').resolve())) state = import_module('atlas_portal.routes.access_request_state') exports = getattr(state, '__all__', None) if exports is None: exports = [name for name in vars(state) if not name.startswith('_')] exports = list(exports) import keyword if any(not isinstance(name, str) or not name.isidentifier() or keyword.iskeyword(name) for name in exports): raise ValueError('Exports require manual review before generating explicit imports') path = Path('backend/atlas_portal/routes/access_requests.py') source = path.read_text() old = 'from .access_request_state import * # noqa: F403 - facade preserves existing patch surface' if source.count(old) != 1: raise ValueError('Expected exactly one matching wildcard import') if exports: replacement = 'from .access_request_state import (\n' + ''.join( f' {name} as {name},\n' for name in exports ) + ')' else: raise ValueError('No exports; review module initialization requirements manually') print(source.replace(old, replacement), end='') ``` ## Links - SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=bstein_home&open=AZ2y3BYyKy9i4pkIpR-L - Full evidence bundle and audit trail live in Ariadne at `/api/admin/audit/events`, event types `hermes_autotriage_incident` and `hermes_autotriage_diagnosis`. Filed automatically by Ariadne from a Hermes Agent diagnosis (run [run_453e4c49d31d4aae9e77f0bd94078817](https://triage.bstein.dev/chat?resume=run_453e4c49d31d4aae9e77f0bd94078817)). Hermes has no write access to this repository; no files or infrastructure were changed.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: bstein/bstein-dev-home#141