[hermes] ariadne: python:S2208 #16

New Issue

hermes-automation · 2026-09-26T20:19:51Z

hermes-automation commented

2026-09-26 20:19:51 +00:00

SonarQube reports python:S2208 in ariadne/services/cluster_state_profiles.py. The build is green; this is a standing finding, not a failure.

What is wrong

Line 5 uses a wildcard import (from .cluster_state_contract import *), which hides which names actually come from the contract module and can silently pollute this module's namespace and its dynamically built __all__. The module only relies on four names from the contract: _NODE_WORKLOAD_TOP and _PROFILE_LIMIT (used in the profile builders) plus ClusterStateSummary and SignalContext (re-exported via the __all__ comprehension at the bottom).

Ariadne opened no pull request for it: no automated patch was possible for this finding.

Facts

gitea — Import only needed names or import the module and then use its members. (CRITICAL, 5min estimated) (ariadne/services/cluster_state_profiles.py:5)

Suggested fix (not applied)

Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch.

ariadne/services/cluster_state_profiles.py — Replace the star import with an explicit import of the only names this module uses or re-exports. _NODE_WORKLOAD_TOP and _PROFILE_LIMIT are referenced directly in _node_profiles, _namespace_profiles, and _workload_profiles; ClusterStateSummary and SignalContext must still be imported by name so the existing __all__ comprehension (which picks them out of globals()) keeps re-exporting them unchanged. Note the two underscore-prefixed constants were only visible through the wildcard because the contract module lists them in its own __all__; importing them explicitly is the dire
... (truncated)

from .cluster_state_contract import (
    _NODE_WORKLOAD_TOP,
    _PROFILE_LIMIT,
    ClusterStateSummary,
    SignalContext,
)

Links

SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=ariadne&open=AZ2y0FYFKy9i4pkIpNlV
Full evidence bundle and audit trail live in Ariadne at /api/admin/audit/events, event types hermes_autotriage_incident and hermes_autotriage_diagnosis.

Filed automatically by Ariadne from a Hermes Agent diagnosis (run run_b75c8bc909574a209d5f97941255d80b). Hermes has no write access to this repository; no files or infrastructure were changed.

SonarQube reports **python:S2208** in `ariadne/services/cluster_state_profiles.py`. The build is green; this is a standing finding, not a failure. ## What is wrong Line 5 uses a wildcard import (`from .cluster_state_contract import *`), which hides which names actually come from the contract module and can silently pollute this module's namespace and its dynamically built `__all__`. The module only relies on four names from the contract: `_NODE_WORKLOAD_TOP` and `_PROFILE_LIMIT` (used in the profile builders) plus `ClusterStateSummary` and `SignalContext` (re-exported via the `__all__` comprehension at the bottom). Ariadne opened no pull request for it: no automated patch was possible for this finding. ## Facts - **gitea** — Import only needed names or import the module and then use its members. (CRITICAL, 5min estimated) (`ariadne/services/cluster_state_profiles.py:5`) ## Suggested fix (not applied) Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch. **`ariadne/services/cluster_state_profiles.py`** — Replace the star import with an explicit import of the only names this module uses or re-exports. `_NODE_WORKLOAD_TOP` and `_PROFILE_LIMIT` are referenced directly in `_node_profiles`, `_namespace_profiles`, and `_workload_profiles`; `ClusterStateSummary` and `SignalContext` must still be imported by name so the existing `__all__` comprehension (which picks them out of `globals()`) keeps re-exporting them unchanged. Note the two underscore-prefixed constants were only visible through the wildcard because the contract module lists them in its own `__all__`; importing them explicitly is the dire ... (truncated) ``` from .cluster_state_contract import ( _NODE_WORKLOAD_TOP, _PROFILE_LIMIT, ClusterStateSummary, SignalContext, ) ``` ## Links - SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=ariadne&open=AZ2y0FYFKy9i4pkIpNlV - Full evidence bundle and audit trail live in Ariadne at `/api/admin/audit/events`, event types `hermes_autotriage_incident` and `hermes_autotriage_diagnosis`. Filed automatically by Ariadne from a Hermes Agent diagnosis (run [run_b75c8bc909574a209d5f97941255d80b](https://triage.bstein.dev/chat?resume=run_b75c8bc909574a209d5f97941255d80b)). Hermes has no write access to this repository; no files or infrastructure were changed.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: titan/ariadne#16