[hermes] bstein_home: python:S2208 #664

New Issue

hermes-automation · 2026-09-30T07:24:18Z

hermes-automation commented

2026-09-30 07:24:18 +00:00

SonarQube reports python:S2208 in backend/atlas_portal/routes/access_requests.py. The build is green; this is a standing finding, not a failure.

What is wrong

Line 8 uses a wildcard import (from .access_request_state import *), so this file no longer says which names the facade re-exports, and any new public name added to access_request_state silently becomes part of this module's surface. The wildcard is deliberate — it binds the state module's names onto this module so sys.modules[name] works as the deps/monkeypatch object — but the identical effect is achieved by importing the same names explicitly.

Ariadne opened no pull request for it: no automated patch was possible for this finding.

Facts

gitea — Import only needed names or import the module and then use its members. (CRITICAL, 5min estimated) (backend/atlas_portal/routes/access_requests.py:8)

Suggested fix (not applied)

Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch.

backend/atlas_portal/routes/access_requests.py — Replace the star import on line 8 with an explicit parenthesised import of the exact set of names the wildcard currently binds: access_request_state's all if it defines one, otherwise every top-level name not starting with an underscore. Each explicitly imported name becomes a module attribute exactly as the wildcard made it, so register() passing sys.modules[name] as deps and any tests that monkeypatch through access_requests keep working unchanged. The list must be complete — not just the names the three register_* modules happen to call — because omitting a name that tests patch or
... (truncated)

from .access_request_state import (
    <public_name_1>,
    <public_name_2>,
    # one line per public name of access_request_state: copy its __all__
    # if defined, otherwise every top-level name not starting with "_".
    # The list must cover the full set the wildcard binds today so the
    # module's attribute/monkeypatch surface stays identical.
)

Links

SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=bstein_home&open=AZ2y3BYyKy9i4pkIpR-L
Full evidence bundle and audit trail live in Ariadne at /api/admin/audit/events, event types hermes_autotriage_incident and hermes_autotriage_diagnosis.

Filed automatically by Ariadne from a Hermes Agent diagnosis (run run_44f6936a50f74939975aa720e4bbfa01). Hermes has no write access to this repository; no files or infrastructure were changed.

SonarQube reports **python:S2208** in `backend/atlas_portal/routes/access_requests.py`. The build is green; this is a standing finding, not a failure. ## What is wrong Line 8 uses a wildcard import (from .access_request_state import *), so this file no longer says which names the facade re-exports, and any new public name added to access_request_state silently becomes part of this module's surface. The wildcard is deliberate — it binds the state module's names onto this module so sys.modules[__name__] works as the deps/monkeypatch object — but the identical effect is achieved by importing the same names explicitly. Ariadne opened no pull request for it: no automated patch was possible for this finding. ## Facts - **gitea** — Import only needed names or import the module and then use its members. (CRITICAL, 5min estimated) (`backend/atlas_portal/routes/access_requests.py:8`) ## Suggested fix (not applied) Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch. **`backend/atlas_portal/routes/access_requests.py`** — Replace the star import on line 8 with an explicit parenthesised import of the exact set of names the wildcard currently binds: access_request_state's __all__ if it defines one, otherwise every top-level name not starting with an underscore. Each explicitly imported name becomes a module attribute exactly as the wildcard made it, so register() passing sys.modules[__name__] as deps and any tests that monkeypatch through access_requests keep working unchanged. The list must be complete — not just the names the three register_* modules happen to call — because omitting a name that tests patch or ... (truncated) ``` from .access_request_state import ( <public_name_1>, <public_name_2>, # one line per public name of access_request_state: copy its __all__ # if defined, otherwise every top-level name not starting with "_". # The list must cover the full set the wildcard binds today so the # module's attribute/monkeypatch surface stays identical. ) ``` ## Links - SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=bstein_home&open=AZ2y3BYyKy9i4pkIpR-L - Full evidence bundle and audit trail live in Ariadne at `/api/admin/audit/events`, event types `hermes_autotriage_incident` and `hermes_autotriage_diagnosis`. Filed automatically by Ariadne from a Hermes Agent diagnosis (run [run_44f6936a50f74939975aa720e4bbfa01](https://triage.bstein.dev/chat?resume=run_44f6936a50f74939975aa720e4bbfa01)). Hermes has no write access to this repository; no files or infrastructure were changed.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: bstein/bstein-dev-home#664