[hermes] bstein_home: python:S2208 #259

New Issue

hermes-automation · 2026-09-24T08:22:40Z

hermes-automation commented

2026-09-24 08:22:40 +00:00

SonarQube reports python:S2208 in backend/atlas_portal/routes/access_requests.py. The build is green; this is a standing finding, not a failure.

What is wrong

The facade uses from .access_request_state import * purely so that sys.modules[__name__] (the deps object passed to the registrars) exposes access_request_state's names as attributes of this module; Sonar flags this because a wildcard import makes the set of names entering the namespace implicit, which risks accidental shadowing and unclear provenance for anyone reading or patching this module.

Ariadne opened no pull request for it: no automated patch was possible for this finding.

Facts

gitea — Import only needed names or import the module and then use its members. (CRITICAL, 5min estimated) (backend/atlas_portal/routes/access_requests.py:8)

Suggested fix (not applied)

Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch.

backend/atlas_portal/routes/access_requests.py — Replace the wildcard import with an explicit list of the names access_request_state.py actually defines (its __all__, or its public functions/constants). This puts exactly the same names into this module's namespace -- preserving the deps patch surface used by the registrars and by existing tests -- while satisfying S2208 by making the imported names explicit. The # noqa: F403 can be dropped since it is no longer needed once the import is explicit. The exact name list depends on access_request_state.py's contents, which a maintainer needs to fill in.

from __future__ import annotations

"""Access request route registration facade."""

import sys

from .access_request_onboarding import register_access_request_onboarding
from .access_request_state import (
    # TODO: list the actual public names defined in access_request_state.py
    # (use its __all__ if present) so this facade keeps exposing exactly
    # what it does today via `import *`.
)
from .access_request_status import register_access_request_status
from .access_request_submission import register_access_request_submission


def register(app) -> None:
    """Register public access-request and onboarding routes."""

    deps = sys.modules[__name__]
    register_access_request_submission(app, deps)
    register_access_request_status(app, deps)
    register_access_request_onboarding(app, deps)

Links

SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=bstein_home&open=AZ2y3BYyKy9i4pkIpR-L
Full evidence bundle and audit trail live in Ariadne at /api/admin/audit/events, event types hermes_autotriage_incident and hermes_autotriage_diagnosis.

Filed automatically by Ariadne from a Hermes Agent diagnosis (run run_ff4ff4f36ad14b38a2a052c58dfe93bc). Hermes has no write access to this repository; no files or infrastructure were changed.

SonarQube reports **python:S2208** in `backend/atlas_portal/routes/access_requests.py`. The build is green; this is a standing finding, not a failure. ## What is wrong The facade uses `from .access_request_state import *` purely so that `sys.modules[__name__]` (the `deps` object passed to the registrars) exposes access_request_state's names as attributes of this module; Sonar flags this because a wildcard import makes the set of names entering the namespace implicit, which risks accidental shadowing and unclear provenance for anyone reading or patching this module. Ariadne opened no pull request for it: no automated patch was possible for this finding. ## Facts - **gitea** — Import only needed names or import the module and then use its members. (CRITICAL, 5min estimated) (`backend/atlas_portal/routes/access_requests.py:8`) ## Suggested fix (not applied) Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch. **`backend/atlas_portal/routes/access_requests.py`** — Replace the wildcard import with an explicit list of the names access_request_state.py actually defines (its `__all__`, or its public functions/constants). This puts exactly the same names into this module's namespace -- preserving the `deps` patch surface used by the registrars and by existing tests -- while satisfying S2208 by making the imported names explicit. The `# noqa: F403` can be dropped since it is no longer needed once the import is explicit. The exact name list depends on access_request_state.py's contents, which a maintainer needs to fill in. ``` from __future__ import annotations """Access request route registration facade.""" import sys from .access_request_onboarding import register_access_request_onboarding from .access_request_state import ( # TODO: list the actual public names defined in access_request_state.py # (use its __all__ if present) so this facade keeps exposing exactly # what it does today via `import *`. ) from .access_request_status import register_access_request_status from .access_request_submission import register_access_request_submission def register(app) -> None: """Register public access-request and onboarding routes.""" deps = sys.modules[__name__] register_access_request_submission(app, deps) register_access_request_status(app, deps) register_access_request_onboarding(app, deps) ``` ## Links - SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=bstein_home&open=AZ2y3BYyKy9i4pkIpR-L - Full evidence bundle and audit trail live in Ariadne at `/api/admin/audit/events`, event types `hermes_autotriage_incident` and `hermes_autotriage_diagnosis`. Filed automatically by Ariadne from a Hermes Agent diagnosis (run [run_ff4ff4f36ad14b38a2a052c58dfe93bc](https://triage.bstein.dev/chat?resume=run_ff4ff4f36ad14b38a2a052c58dfe93bc)). Hermes has no write access to this repository; no files or infrastructure were changed.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: bstein/bstein-dev-home#259