[hermes] bstein_home: python:S2208 #761

New Issue

hermes-automation · 2026-09-30T11:28:29Z

hermes-automation commented

2026-09-30 11:28:29 +00:00

SonarQube reports python:S2208 in backend/atlas_portal/routes/access_requests.py. The build is green; this is a standing finding, not a failure.

What is wrong

Line 8 uses a wildcard import (from .access_request_state import *) to re-export that module's names into this facade, so neither readers nor static analysis can tell which names this module actually exposes. The facade genuinely depends on those names being module attributes, because register() passes sys.modules[__name__] as deps and the register_* functions (and test monkeypatches) resolve dependencies as attributes of this module — so the fix is to make that re-export surface explicit rather than remove it.

Ariadne opened no pull request for it: no automated patch was possible for this finding.

Facts

gitea — Import only needed names or import the module and then use its members. (CRITICAL, 5min estimated) (backend/atlas_portal/routes/access_requests.py:8)

Suggested fix (not applied)

Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch.

backend/atlas_portal/routes/access_requests.py — Replace the star import with an explicit parenthesized import of every public name that access_request_state exports (its all if defined, otherwise all non-underscore top-level names). This keeps each name bound as an attribute of this module, so the deps = sys.modules[__name__] lookup in register() and any test patches targeting access_requests.<name> keep working exactly as before, while satisfying S2208. The # noqa: F401 replaces the old F403 comment because the imported names are intentionally 're-exported but unused' in this file. The placeholders below must be filled in from ac
... (truncated)

from .access_request_state import (  # noqa: F401 - facade preserves existing patch surface
    <public_name_1>,
    <public_name_2>,
    <public_name_3>,
)

Links

SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=bstein_home&open=AZ2y3BYyKy9i4pkIpR-L
Full evidence bundle and audit trail live in Ariadne at /api/admin/audit/events, event types hermes_autotriage_incident and hermes_autotriage_diagnosis.

Filed automatically by Ariadne from a Hermes Agent diagnosis (run run_e412832e8bd34dec98911ce00c993300). Hermes has no write access to this repository; no files or infrastructure were changed.

SonarQube reports **python:S2208** in `backend/atlas_portal/routes/access_requests.py`. The build is green; this is a standing finding, not a failure. ## What is wrong Line 8 uses a wildcard import (`from .access_request_state import *`) to re-export that module's names into this facade, so neither readers nor static analysis can tell which names this module actually exposes. The facade genuinely depends on those names being module attributes, because register() passes `sys.modules[__name__]` as `deps` and the register_* functions (and test monkeypatches) resolve dependencies as attributes of this module — so the fix is to make that re-export surface explicit rather than remove it. Ariadne opened no pull request for it: no automated patch was possible for this finding. ## Facts - **gitea** — Import only needed names or import the module and then use its members. (CRITICAL, 5min estimated) (`backend/atlas_portal/routes/access_requests.py:8`) ## Suggested fix (not applied) Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch. **`backend/atlas_portal/routes/access_requests.py`** — Replace the star import with an explicit parenthesized import of every public name that access_request_state exports (its __all__ if defined, otherwise all non-underscore top-level names). This keeps each name bound as an attribute of this module, so the `deps = sys.modules[__name__]` lookup in register() and any test patches targeting `access_requests.<name>` keep working exactly as before, while satisfying S2208. The `# noqa: F401` replaces the old F403 comment because the imported names are intentionally 're-exported but unused' in this file. The placeholders below must be filled in from ac ... (truncated) ``` from .access_request_state import ( # noqa: F401 - facade preserves existing patch surface <public_name_1>, <public_name_2>, <public_name_3>, ) ``` ## Links - SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=bstein_home&open=AZ2y3BYyKy9i4pkIpR-L - Full evidence bundle and audit trail live in Ariadne at `/api/admin/audit/events`, event types `hermes_autotriage_incident` and `hermes_autotriage_diagnosis`. Filed automatically by Ariadne from a Hermes Agent diagnosis (run [run_e412832e8bd34dec98911ce00c993300](https://triage.bstein.dev/chat?resume=run_e412832e8bd34dec98911ce00c993300)). Hermes has no write access to this repository; no files or infrastructure were changed.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: bstein/bstein-dev-home#761