[hermes] ariadne: python:S2208 #11

New Issue

hermes-automation · 2026-09-22T05:24:16Z

hermes-automation commented

2026-09-22 05:24:16 +00:00

SonarQube reports python:S2208 in ariadne/services/cluster_state_profiles.py. The build is green; this is a standing finding, not a failure.

What is wrong

The wildcard import hides which names this module obtains from cluster_state_contract. Because the final dynamic all also re-exports imported underscore-prefixed names and any imported ClusterStateSummary or SignalContext, replacing it with only the two constants used by the functions could change the module's public interface.

Ariadne opened no pull request for it: no automated patch was possible for this finding.

Facts

gitea — Import only needed names or import the module and then use its members. (CRITICAL, 5min estimated) (ariadne/services/cluster_state_profiles.py:5)

Suggested fix (not applied)

Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch.

ariadne/services/cluster_state_profiles.py — Replace the wildcard with explicit named imports. The following are the dependencies visible in the function bodies, but this is not a complete drop-in replacement until the maintainer checks cluster_state_contract and adds every other name currently imported and exposed to callers, including re-exports selected by this file's all. Keep the function bodies and existing all unchanged. Enumerating the existing imported names removes the wildcard without changing their bindings or silently dropping exports.

from .cluster_state_contract import (
    _NODE_WORKLOAD_TOP,
    _PROFILE_LIMIT,
)

Links

SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=ariadne&open=AZ2y0FYFKy9i4pkIpNlV
Full evidence bundle and audit trail live in Ariadne at /api/admin/audit/events, event types hermes_autotriage_incident and hermes_autotriage_diagnosis.

Filed automatically by Ariadne from a Hermes Agent diagnosis (run run_f36ab3ff3f6442eb9ade898395f43739). Hermes has no write access to this repository; no files or infrastructure were changed.

SonarQube reports **python:S2208** in `ariadne/services/cluster_state_profiles.py`. The build is green; this is a standing finding, not a failure. ## What is wrong The wildcard import hides which names this module obtains from cluster_state_contract. Because the final dynamic __all__ also re-exports imported underscore-prefixed names and any imported ClusterStateSummary or SignalContext, replacing it with only the two constants used by the functions could change the module's public interface. Ariadne opened no pull request for it: no automated patch was possible for this finding. ## Facts - **gitea** — Import only needed names or import the module and then use its members. (CRITICAL, 5min estimated) (`ariadne/services/cluster_state_profiles.py:5`) ## Suggested fix (not applied) Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch. **`ariadne/services/cluster_state_profiles.py`** — Replace the wildcard with explicit named imports. The following are the dependencies visible in the function bodies, but this is not a complete drop-in replacement until the maintainer checks cluster_state_contract and adds every other name currently imported and exposed to callers, including re-exports selected by this file's __all__. Keep the function bodies and existing __all__ unchanged. Enumerating the existing imported names removes the wildcard without changing their bindings or silently dropping exports. ``` from .cluster_state_contract import ( _NODE_WORKLOAD_TOP, _PROFILE_LIMIT, ) ``` ## Links - SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=ariadne&open=AZ2y0FYFKy9i4pkIpNlV - Full evidence bundle and audit trail live in Ariadne at `/api/admin/audit/events`, event types `hermes_autotriage_incident` and `hermes_autotriage_diagnosis`. Filed automatically by Ariadne from a Hermes Agent diagnosis (run [run_f36ab3ff3f6442eb9ade898395f43739](https://triage.bstein.dev/chat?resume=run_f36ab3ff3f6442eb9ade898395f43739)). Hermes has no write access to this repository; no files or infrastructure were changed.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: titan/ariadne#11