[hermes] ariadne: python:S2208 #15

New Issue

hermes-automation · 2026-09-23T06:24:19Z

hermes-automation commented

2026-09-23 06:24:19 +00:00

SonarQube reports python:S2208 in ariadne/services/cluster_state_profiles.py. The build is green; this is a standing finding, not a failure.

What is wrong

The wildcard import from .cluster_state_contract import * pulls the entire module namespace into cluster_state_profiles.py, but the file only actually uses four names from it: ClusterStateSummary and SignalContext (referenced by the all re-export check) and _NODE_WORKLOAD_TOP and _PROFILE_LIMIT (used directly in _node_profiles/_namespace_profiles/_workload_profiles). An explicit import makes the dependency set visible and avoids accidentally shadowing or re-exporting unrelated names.

Ariadne opened no pull request for it: no automated patch was possible for this finding.

Facts

gitea — Import only needed names or import the module and then use its members. (CRITICAL, 5min estimated) (ariadne/services/cluster_state_profiles.py:5)

Suggested fix (not applied)

Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch.

ariadne/services/cluster_state_profiles.py — Replace the wildcard import with an explicit import of just the names this module actually consumes (ClusterStateSummary, SignalContext for the all re-export, and _NODE_WORKLOAD_TOP/_PROFILE_LIMIT used in the profile-building functions). This satisfies S2208 without changing runtime behavior, since the same names are still bound in this module's globals() for the all computation at the bottom of the file.

from .cluster_state_contract import (
    ClusterStateSummary,
    SignalContext,
    _NODE_WORKLOAD_TOP,
    _PROFILE_LIMIT,
)

Links

SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=ariadne&open=AZ2y0FYFKy9i4pkIpNlV
Full evidence bundle and audit trail live in Ariadne at /api/admin/audit/events, event types hermes_autotriage_incident and hermes_autotriage_diagnosis.

Filed automatically by Ariadne from a Hermes Agent diagnosis (run run_527d83608f224f94a2405cdf080d5905). Hermes has no write access to this repository; no files or infrastructure were changed.

SonarQube reports **python:S2208** in `ariadne/services/cluster_state_profiles.py`. The build is green; this is a standing finding, not a failure. ## What is wrong The wildcard import `from .cluster_state_contract import *` pulls the entire module namespace into cluster_state_profiles.py, but the file only actually uses four names from it: ClusterStateSummary and SignalContext (referenced by the __all__ re-export check) and _NODE_WORKLOAD_TOP and _PROFILE_LIMIT (used directly in _node_profiles/_namespace_profiles/_workload_profiles). An explicit import makes the dependency set visible and avoids accidentally shadowing or re-exporting unrelated names. Ariadne opened no pull request for it: no automated patch was possible for this finding. ## Facts - **gitea** — Import only needed names or import the module and then use its members. (CRITICAL, 5min estimated) (`ariadne/services/cluster_state_profiles.py:5`) ## Suggested fix (not applied) Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch. **`ariadne/services/cluster_state_profiles.py`** — Replace the wildcard import with an explicit import of just the names this module actually consumes (ClusterStateSummary, SignalContext for the __all__ re-export, and _NODE_WORKLOAD_TOP/_PROFILE_LIMIT used in the profile-building functions). This satisfies S2208 without changing runtime behavior, since the same names are still bound in this module's globals() for the __all__ computation at the bottom of the file. ``` from .cluster_state_contract import ( ClusterStateSummary, SignalContext, _NODE_WORKLOAD_TOP, _PROFILE_LIMIT, ) ``` ## Links - SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=ariadne&open=AZ2y0FYFKy9i4pkIpNlV - Full evidence bundle and audit trail live in Ariadne at `/api/admin/audit/events`, event types `hermes_autotriage_incident` and `hermes_autotriage_diagnosis`. Filed automatically by Ariadne from a Hermes Agent diagnosis (run [run_527d83608f224f94a2405cdf080d5905](https://triage.bstein.dev/chat?resume=run_527d83608f224f94a2405cdf080d5905)). Hermes has no write access to this repository; no files or infrastructure were changed.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: titan/ariadne#15