[hermes] ariadne: python:S2208 #144

New Issue

hermes-automation · 2026-10-31T04:20:54Z

hermes-automation commented

2026-10-31 04:20:54 +00:00

SonarQube reports python:S2208 in ariadne/services/cluster_state_profiles.py. The build is green; this is a standing finding, not a failure.

What is wrong

The module uses a wildcard import from cluster_state_contract, which obscures its dependencies and triggers S2208. Importing the four names used or re-exported by this module explicitly preserves its current behavior.

Ariadne opened no pull request for it: no automated patch was possible for this finding.

Facts

gitea — Import only needed names or import the module and then use its members. (CRITICAL, 5min estimated) (ariadne/services/cluster_state_profiles.py:5)

Suggested fix (not applied)

Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch.

ariadne/services/cluster_state_profiles.py — Replace the wildcard import with explicit imports for the two constants used by the profile builders and the two contract types retained in all. This keeps the same available globals and exports without importing unrelated names.

from .cluster_state_contract import (
    ClusterStateSummary,
    SignalContext,
    _NODE_WORKLOAD_TOP,
    _PROFILE_LIMIT,
)

Links

SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=ariadne&open=AZ2y0FYFKy9i4pkIpNlV
Full evidence bundle and audit trail live in Ariadne at /api/admin/audit/events, event types hermes_autotriage_incident and hermes_autotriage_diagnosis.

Filed automatically by Ariadne from a Hermes Agent diagnosis (run run_02b138519e174242ba8dc631645b1bce). Hermes has no write access to this repository; no files or infrastructure were changed.

SonarQube reports **python:S2208** in `ariadne/services/cluster_state_profiles.py`. The build is green; this is a standing finding, not a failure. ## What is wrong The module uses a wildcard import from cluster_state_contract, which obscures its dependencies and triggers S2208. Importing the four names used or re-exported by this module explicitly preserves its current behavior. Ariadne opened no pull request for it: no automated patch was possible for this finding. ## Facts - **gitea** — Import only needed names or import the module and then use its members. (CRITICAL, 5min estimated) (`ariadne/services/cluster_state_profiles.py:5`) ## Suggested fix (not applied) Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch. **`ariadne/services/cluster_state_profiles.py`** — Replace the wildcard import with explicit imports for the two constants used by the profile builders and the two contract types retained in __all__. This keeps the same available globals and exports without importing unrelated names. ``` from .cluster_state_contract import ( ClusterStateSummary, SignalContext, _NODE_WORKLOAD_TOP, _PROFILE_LIMIT, ) ``` ## Links - SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=ariadne&open=AZ2y0FYFKy9i4pkIpNlV - Full evidence bundle and audit trail live in Ariadne at `/api/admin/audit/events`, event types `hermes_autotriage_incident` and `hermes_autotriage_diagnosis`. Filed automatically by Ariadne from a Hermes Agent diagnosis (run [run_02b138519e174242ba8dc631645b1bce](https://triage.bstein.dev/chat?resume=run_02b138519e174242ba8dc631645b1bce)). Hermes has no write access to this repository; no files or infrastructure were changed.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: titan/ariadne#144