[hermes] bstein_home: python:S2208 #710

New Issue

hermes-automation · 2026-09-30T10:25:46Z

hermes-automation commented

2026-09-30 10:25:46 +00:00

SonarQube reports python:S2208 in backend/atlas_portal/routes/access_requests.py. The build is green; this is a standing finding, not a failure.

What is wrong

Line 8 uses a wildcard import (from .access_request_state import *) to re-export that module's names onto this facade, which is what python:S2208 flags: it hides which names the facade actually provides and which names the registrars resolve via deps.<name>. The fix is to import the same names explicitly so the module's public surface is visible, while keeping every name bound on this module so deps = sys.modules[__name__] and existing test monkeypatching keep working unchanged.

Ariadne opened no pull request for it: no automated patch was possible for this finding.

Facts

gitea — Import only needed names or import the module and then use its members. (CRITICAL, 5min estimated) (backend/atlas_portal/routes/access_requests.py:8)

Suggested fix (not applied)

Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch.

backend/atlas_portal/routes/access_requests.py — Replace the star import with an explicit import of every public name that access_request_state currently exports. The list must be taken from access_request_state.py itself (its all if defined, otherwise every top-level name not starting with an underscore); cross-check it against the deps.<attribute> lookups in access_request_submission, access_request_status, and access_request_onboarding so nothing the registrars or tests rely on is dropped. Because the names are re-exported rather than used directly in this file, keep a # noqa: F401 (or use the import x as x re-export convention)
... (truncated)

from __future__ import annotations

"""Access request route registration facade."""

import sys

from .access_request_onboarding import register_access_request_onboarding
from .access_request_state import (  # noqa: F401 - re-exported to preserve the existing patch surface
    # Fill in every public name defined by access_request_state.py —
    # its __all__ if one is defined, otherwise each top-level name that
    # does not start with "_". These are the names the registrars read
    # via `deps.<name>` and that tests monkeypatch on this module.
    <public_name_1>,
    <public_name_2>,
)
from .access_request_status import register_access_request_status
from .access_request_submission import register_access_request_submission


def register(app) -> None:
    """Register public access-request and onboarding routes."""

    deps = sys.modules[__name__]
    register_access_request_submission(app, deps)
    register_access_request_status(app, deps)
    register_access_request_onboarding(app, deps)

Links

SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=bstein_home&open=AZ2y3BYyKy9i4pkIpR-L
Full evidence bundle and audit trail live in Ariadne at /api/admin/audit/events, event types hermes_autotriage_incident and hermes_autotriage_diagnosis.

Filed automatically by Ariadne from a Hermes Agent diagnosis (run run_8981fcbe243c42de94653f9c61aae4c3). Hermes has no write access to this repository; no files or infrastructure were changed.

SonarQube reports **python:S2208** in `backend/atlas_portal/routes/access_requests.py`. The build is green; this is a standing finding, not a failure. ## What is wrong Line 8 uses a wildcard import (`from .access_request_state import *`) to re-export that module's names onto this facade, which is what python:S2208 flags: it hides which names the facade actually provides and which names the registrars resolve via `deps.<name>`. The fix is to import the same names explicitly so the module's public surface is visible, while keeping every name bound on this module so `deps = sys.modules[__name__]` and existing test monkeypatching keep working unchanged. Ariadne opened no pull request for it: no automated patch was possible for this finding. ## Facts - **gitea** — Import only needed names or import the module and then use its members. (CRITICAL, 5min estimated) (`backend/atlas_portal/routes/access_requests.py:8`) ## Suggested fix (not applied) Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch. **`backend/atlas_portal/routes/access_requests.py`** — Replace the star import with an explicit import of every public name that access_request_state currently exports. The list must be taken from access_request_state.py itself (its __all__ if defined, otherwise every top-level name not starting with an underscore); cross-check it against the `deps.<attribute>` lookups in access_request_submission, access_request_status, and access_request_onboarding so nothing the registrars or tests rely on is dropped. Because the names are re-exported rather than used directly in this file, keep a `# noqa: F401` (or use the `import x as x` re-export convention) ... (truncated) ``` from __future__ import annotations """Access request route registration facade.""" import sys from .access_request_onboarding import register_access_request_onboarding from .access_request_state import ( # noqa: F401 - re-exported to preserve the existing patch surface # Fill in every public name defined by access_request_state.py — # its __all__ if one is defined, otherwise each top-level name that # does not start with "_". These are the names the registrars read # via `deps.<name>` and that tests monkeypatch on this module. <public_name_1>, <public_name_2>, ) from .access_request_status import register_access_request_status from .access_request_submission import register_access_request_submission def register(app) -> None: """Register public access-request and onboarding routes.""" deps = sys.modules[__name__] register_access_request_submission(app, deps) register_access_request_status(app, deps) register_access_request_onboarding(app, deps) ``` ## Links - SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=bstein_home&open=AZ2y3BYyKy9i4pkIpR-L - Full evidence bundle and audit trail live in Ariadne at `/api/admin/audit/events`, event types `hermes_autotriage_incident` and `hermes_autotriage_diagnosis`. Filed automatically by Ariadne from a Hermes Agent diagnosis (run [run_8981fcbe243c42de94653f9c61aae4c3](https://triage.bstein.dev/chat?resume=run_8981fcbe243c42de94653f9c61aae4c3)). Hermes has no write access to this repository; no files or infrastructure were changed.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: bstein/bstein-dev-home#710