[hermes] ariadne: python:S2208 #129

New Issue

hermes-automation · 2026-09-28T08:20:52Z

hermes-automation commented

2026-09-28 08:20:52 +00:00

SonarQube reports python:S2208 in ariadne/services/cluster_state_profiles.py. The build is green; this is a standing finding, not a failure.

What is wrong

Line 5 uses a wildcard import (from .cluster_state_contract import *), which hides which names actually come from the contract module and pollutes the module namespace. Only four imported names are actually referenced in this file: _NODE_WORKLOAD_TOP and _PROFILE_LIMIT (used as limits in the profile builders) and ClusterStateSummary and SignalContext (needed in globals() so the dynamic all at the bottom re-exports them).

Ariadne opened no pull request for it: no automated patch was possible for this finding.

Facts

gitea — Import only needed names or import the module and then use its members. (CRITICAL, 5min estimated) (ariadne/services/cluster_state_profiles.py:5)

Suggested fix (not applied)

Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch.

ariadne/services/cluster_state_profiles.py — Replace the star import with an explicit import of the names this module actually uses. _NODE_WORKLOAD_TOP and _PROFILE_LIMIT are referenced directly; ClusterStateSummary and SignalContext must be present in the module's globals for the all comprehension on the last line to include them, so they must be imported explicitly too. One caveat for the maintainer: the dynamic all also re-exports any underscore-prefixed name the star import happened to pull in from cluster_state_contract; if downstream code relies on additional contract names being re-exported through this module, add those n
... (truncated)

from __future__ import annotations

from typing import Any

from .cluster_state_contract import (
    ClusterStateSummary,
    SignalContext,
    _NODE_WORKLOAD_TOP,
    _PROFILE_LIMIT,
)

Links

SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=ariadne&open=AZ2y0FYFKy9i4pkIpNlV
Full evidence bundle and audit trail live in Ariadne at /api/admin/audit/events, event types hermes_autotriage_incident and hermes_autotriage_diagnosis.

Filed automatically by Ariadne from a Hermes Agent diagnosis (run run_17afe62fc8464d0baba7bedb4d30d43c). Hermes has no write access to this repository; no files or infrastructure were changed.

SonarQube reports **python:S2208** in `ariadne/services/cluster_state_profiles.py`. The build is green; this is a standing finding, not a failure. ## What is wrong Line 5 uses a wildcard import (`from .cluster_state_contract import *`), which hides which names actually come from the contract module and pollutes the module namespace. Only four imported names are actually referenced in this file: _NODE_WORKLOAD_TOP and _PROFILE_LIMIT (used as limits in the profile builders) and ClusterStateSummary and SignalContext (needed in globals() so the dynamic __all__ at the bottom re-exports them). Ariadne opened no pull request for it: no automated patch was possible for this finding. ## Facts - **gitea** — Import only needed names or import the module and then use its members. (CRITICAL, 5min estimated) (`ariadne/services/cluster_state_profiles.py:5`) ## Suggested fix (not applied) Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch. **`ariadne/services/cluster_state_profiles.py`** — Replace the star import with an explicit import of the names this module actually uses. _NODE_WORKLOAD_TOP and _PROFILE_LIMIT are referenced directly; ClusterStateSummary and SignalContext must be present in the module's globals for the __all__ comprehension on the last line to include them, so they must be imported explicitly too. One caveat for the maintainer: the dynamic __all__ also re-exports any underscore-prefixed name the star import happened to pull in from cluster_state_contract; if downstream code relies on additional contract names being re-exported through this module, add those n ... (truncated) ``` from __future__ import annotations from typing import Any from .cluster_state_contract import ( ClusterStateSummary, SignalContext, _NODE_WORKLOAD_TOP, _PROFILE_LIMIT, ) ``` ## Links - SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=ariadne&open=AZ2y0FYFKy9i4pkIpNlV - Full evidence bundle and audit trail live in Ariadne at `/api/admin/audit/events`, event types `hermes_autotriage_incident` and `hermes_autotriage_diagnosis`. Filed automatically by Ariadne from a Hermes Agent diagnosis (run [run_17afe62fc8464d0baba7bedb4d30d43c](https://triage.bstein.dev/chat?resume=run_17afe62fc8464d0baba7bedb4d30d43c)). Hermes has no write access to this repository; no files or infrastructure were changed.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: titan/ariadne#129