[hermes] bstein_home: python:S2208 #530

New Issue

hermes-automation · 2026-09-27T18:25:22Z

hermes-automation commented

2026-09-27 18:25:22 +00:00

SonarQube reports python:S2208 in backend/atlas_portal/routes/access_requests.py. The build is green; this is a standing finding, not a failure.

What is wrong

Line 8 wildcard-imports everything from .access_request_state, so neither readers nor static analysis can tell which names this facade re-exports. The wildcard is load-bearing here: register() passes this module (sys.modules[name]) as deps, and the noqa comment says tests patch those re-exported names on this module, so the fix must keep every public name of access_request_state bound at module level.

Ariadne opened no pull request for it: no automated patch was possible for this finding.

Facts

gitea — Import only needed names or import the module and then use its members. (CRITICAL, 5min estimated) (backend/atlas_portal/routes/access_requests.py:8)

Suggested fix (not applied)

Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch.

backend/atlas_portal/routes/access_requests.py — Replace the star import (and its noqa: F403 comment, which becomes unnecessary) with an explicit import of every public name access_request_state exports: copy the contents of its all if it defines one, otherwise every module-level name that does not start with an underscore. Star-import semantics are exactly that set, so an explicit list of those same names is behavior-identical — the names stay bound on this module, deps = sys.modules[name] still exposes them to the registration functions, and existing test patches on this module keep working — while satisfying S2208 by making the im
... (truncated)

from .access_request_onboarding import register_access_request_onboarding
from .access_request_state import (
    # explicit list of every public name access_request_state exports;
    # these must stay bound on this module because register() passes this
    # module as `deps` and tests patch these names here
    <name_1>,
    <name_2>,
    ...
)
from .access_request_status import register_access_request_status
from .access_request_submission import register_access_request_submission

Links

SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=bstein_home&open=AZ2y3BYyKy9i4pkIpR-L
Full evidence bundle and audit trail live in Ariadne at /api/admin/audit/events, event types hermes_autotriage_incident and hermes_autotriage_diagnosis.

Filed automatically by Ariadne from a Hermes Agent diagnosis (run run_27a11c5d7b0a424daf8bea9cef3805f7). Hermes has no write access to this repository; no files or infrastructure were changed.

SonarQube reports **python:S2208** in `backend/atlas_portal/routes/access_requests.py`. The build is green; this is a standing finding, not a failure. ## What is wrong Line 8 wildcard-imports everything from .access_request_state, so neither readers nor static analysis can tell which names this facade re-exports. The wildcard is load-bearing here: register() passes this module (sys.modules[__name__]) as deps, and the noqa comment says tests patch those re-exported names on this module, so the fix must keep every public name of access_request_state bound at module level. Ariadne opened no pull request for it: no automated patch was possible for this finding. ## Facts - **gitea** — Import only needed names or import the module and then use its members. (CRITICAL, 5min estimated) (`backend/atlas_portal/routes/access_requests.py:8`) ## Suggested fix (not applied) Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch. **`backend/atlas_portal/routes/access_requests.py`** — Replace the star import (and its noqa: F403 comment, which becomes unnecessary) with an explicit import of every public name access_request_state exports: copy the contents of its __all__ if it defines one, otherwise every module-level name that does not start with an underscore. Star-import semantics are exactly that set, so an explicit list of those same names is behavior-identical — the names stay bound on this module, deps = sys.modules[__name__] still exposes them to the registration functions, and existing test patches on this module keep working — while satisfying S2208 by making the im ... (truncated) ``` from .access_request_onboarding import register_access_request_onboarding from .access_request_state import ( # explicit list of every public name access_request_state exports; # these must stay bound on this module because register() passes this # module as `deps` and tests patch these names here <name_1>, <name_2>, ... ) from .access_request_status import register_access_request_status from .access_request_submission import register_access_request_submission ``` ## Links - SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=bstein_home&open=AZ2y3BYyKy9i4pkIpR-L - Full evidence bundle and audit trail live in Ariadne at `/api/admin/audit/events`, event types `hermes_autotriage_incident` and `hermes_autotriage_diagnosis`. Filed automatically by Ariadne from a Hermes Agent diagnosis (run [run_27a11c5d7b0a424daf8bea9cef3805f7](https://triage.bstein.dev/chat?resume=run_27a11c5d7b0a424daf8bea9cef3805f7)). Hermes has no write access to this repository; no files or infrastructure were changed.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: bstein/bstein-dev-home#530