[hermes] bstein_home: python:S2208 #475

New Issue

hermes-automation · 2026-09-27T09:34:13Z

hermes-automation commented

2026-09-27 09:34:13 +00:00

SonarQube reports python:S2208 in backend/atlas_portal/routes/access_requests.py. The build is green; this is a standing finding, not a failure.

What is wrong

Line 8 uses a wildcard import (from .access_request_state import *), which SonarQube flags because it hides which names the module actually pulls in and can silently shadow or leak names. The star import is load-bearing here: it re-exports access_request_state's public names as attributes of this module so tests can patch them via deps = sys.modules[__name__], so the fix must enumerate those same names explicitly rather than drop the re-export.

Ariadne opened no pull request for it: no automated patch was possible for this finding.

Facts

gitea — Import only needed names or import the module and then use its members. (CRITICAL, 5min estimated) (backend/atlas_portal/routes/access_requests.py:8)

Suggested fix (not applied)

Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch.

backend/atlas_portal/routes/access_requests.py — Replace the wildcard with an explicit import of every public name from access_request_state (its __all__ if defined, otherwise every top-level name not starting with an underscore). This keeps each name bound as a module attribute on access_requests, so the existing patch surface used by deps = sys.modules[__name__] and by tests that monkeypatch access_requests.<name> is preserved exactly, while satisfying S2208 and letting the # noqa: F403 be removed. The maintainer must fill in the real name list from access_request_state.py, which was not available to me for verification.

from .access_request_state import (  # facade preserves existing patch surface
    # Replace this list with every public name defined in
    # access_request_state (its __all__ if present, otherwise all
    # top-level names that do not start with "_"), e.g.:
    get_access_request,
    save_access_request,
    update_access_request_state,
)

Links

SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=bstein_home&open=AZ2y3BYyKy9i4pkIpR-L
Full evidence bundle and audit trail live in Ariadne at /api/admin/audit/events, event types hermes_autotriage_incident and hermes_autotriage_diagnosis.

Filed automatically by Ariadne from a Hermes Agent diagnosis (run run_65f5f39217534ae386592953aa8bba90). Hermes has no write access to this repository; no files or infrastructure were changed.

SonarQube reports **python:S2208** in `backend/atlas_portal/routes/access_requests.py`. The build is green; this is a standing finding, not a failure. ## What is wrong Line 8 uses a wildcard import (`from .access_request_state import *`), which SonarQube flags because it hides which names the module actually pulls in and can silently shadow or leak names. The star import is load-bearing here: it re-exports access_request_state's public names as attributes of this module so tests can patch them via `deps = sys.modules[__name__]`, so the fix must enumerate those same names explicitly rather than drop the re-export. Ariadne opened no pull request for it: no automated patch was possible for this finding. ## Facts - **gitea** — Import only needed names or import the module and then use its members. (CRITICAL, 5min estimated) (`backend/atlas_portal/routes/access_requests.py:8`) ## Suggested fix (not applied) Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch. **`backend/atlas_portal/routes/access_requests.py`** — Replace the wildcard with an explicit import of every public name from access_request_state (its `__all__` if defined, otherwise every top-level name not starting with an underscore). This keeps each name bound as a module attribute on access_requests, so the existing patch surface used by `deps = sys.modules[__name__]` and by tests that monkeypatch `access_requests.<name>` is preserved exactly, while satisfying S2208 and letting the `# noqa: F403` be removed. The maintainer must fill in the real name list from access_request_state.py, which was not available to me for verification. ``` from .access_request_state import ( # facade preserves existing patch surface # Replace this list with every public name defined in # access_request_state (its __all__ if present, otherwise all # top-level names that do not start with "_"), e.g.: get_access_request, save_access_request, update_access_request_state, ) ``` ## Links - SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=bstein_home&open=AZ2y3BYyKy9i4pkIpR-L - Full evidence bundle and audit trail live in Ariadne at `/api/admin/audit/events`, event types `hermes_autotriage_incident` and `hermes_autotriage_diagnosis`. Filed automatically by Ariadne from a Hermes Agent diagnosis (run [run_65f5f39217534ae386592953aa8bba90](https://triage.bstein.dev/chat?resume=run_65f5f39217534ae386592953aa8bba90)). Hermes has no write access to this repository; no files or infrastructure were changed.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: bstein/bstein-dev-home#475