[hermes] bstein_home: python:S2208 #42

New Issue

hermes-automation · 2026-09-20T21:22:19Z

hermes-automation commented

2026-09-20 21:22:19 +00:00

SonarQube reports python:S2208 in backend/atlas_portal/routes/access_requests.py. The build is green; this is a standing finding, not a failure.

What is wrong

Line 8 uses a wildcard import (from .access_request_state import *), which hides which names actually enter this module's namespace. The facade depends on those names being present on sys.modules[__name__] (passed to the register functions as deps), so they need to be imported explicitly by name rather than via *.

Ariadne opened no pull request for it: no automated patch was possible for this finding.

Facts

gitea — Import only needed names or import the module and then use its members. (CRITICAL, 5min estimated) (backend/atlas_portal/routes/access_requests.py:8)

Suggested fix (not applied)

Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch.

backend/atlas_portal/routes/access_requests.py — Replace the star import with an explicit named import of every public name that access_request_state exports (its __all__ if defined, otherwise its public module-level names). This keeps the exact same set of attributes on the facade module, so sys.modules[__name__] still exposes everything the register functions and any test patches (access_requests.<name>) rely on, while satisfying S2208. The # noqa: F403 comment can be dropped since there is no longer a wildcard import; the names are re-exported (not locally used), so keep a short comment noting they are intentional re-exports for
... (truncated)

from .access_request_state import (  # re-exported: facade preserves existing patch surface
    <public name 1 from access_request_state>,
    <public name 2 from access_request_state>,
    <... every remaining public name access_request_state exports ...>,
)

Links

SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=bstein_home&open=AZ2y3BYyKy9i4pkIpR-L
Full evidence bundle and audit trail live in Ariadne at /api/admin/audit/events, event types hermes_autotriage_incident and hermes_autotriage_diagnosis.

Filed automatically by Ariadne from a Hermes Agent diagnosis (run run_354b87fda9a3495fbf3d803e5683b94b). Hermes has no write access to this repository; no files or infrastructure were changed.

SonarQube reports **python:S2208** in `backend/atlas_portal/routes/access_requests.py`. The build is green; this is a standing finding, not a failure. ## What is wrong Line 8 uses a wildcard import (`from .access_request_state import *`), which hides which names actually enter this module's namespace. The facade depends on those names being present on `sys.modules[__name__]` (passed to the register functions as `deps`), so they need to be imported explicitly by name rather than via `*`. Ariadne opened no pull request for it: no automated patch was possible for this finding. ## Facts - **gitea** — Import only needed names or import the module and then use its members. (CRITICAL, 5min estimated) (`backend/atlas_portal/routes/access_requests.py:8`) ## Suggested fix (not applied) Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch. **`backend/atlas_portal/routes/access_requests.py`** — Replace the star import with an explicit named import of every public name that `access_request_state` exports (its `__all__` if defined, otherwise its public module-level names). This keeps the exact same set of attributes on the facade module, so `sys.modules[__name__]` still exposes everything the register functions and any test patches (`access_requests.<name>`) rely on, while satisfying S2208. The `# noqa: F403` comment can be dropped since there is no longer a wildcard import; the names are re-exported (not locally used), so keep a short comment noting they are intentional re-exports for ... (truncated) ``` from .access_request_state import ( # re-exported: facade preserves existing patch surface <public name 1 from access_request_state>, <public name 2 from access_request_state>, <... every remaining public name access_request_state exports ...>, ) ``` ## Links - SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=bstein_home&open=AZ2y3BYyKy9i4pkIpR-L - Full evidence bundle and audit trail live in Ariadne at `/api/admin/audit/events`, event types `hermes_autotriage_incident` and `hermes_autotriage_diagnosis`. Filed automatically by Ariadne from a Hermes Agent diagnosis (run [run_354b87fda9a3495fbf3d803e5683b94b](https://triage.bstein.dev/chat?resume=run_354b87fda9a3495fbf3d803e5683b94b)). Hermes has no write access to this repository; no files or infrastructure were changed.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: bstein/bstein-dev-home#42