[hermes] metis: go:S3776 #323

New Issue

hermes-automation · 2026-09-29T23:27:29Z

hermes-automation commented

2026-09-29 23:27:29 +00:00

SonarQube reports go:S3776 in pkg/sentinel/collector.go. The build is green; this is a standing finding, not a failure.

What is wrong

parseUSBScratchFstab (line 131) reaches cognitive complexity 17 because the fstab-entry handling (empty/comment skip, field count check, bind detection, tmpfs skip, UUID=/LABEL= prefix parsing) is all nested inside the marker-block switch inside the line loop, so every condition pays a nesting penalty and the boolean operator chains add more. Extracting the per-entry handling into a helper removes the nesting penalties without changing behaviour.

Ariadne opened no pull request for it: no automated patch was possible for this finding.

Facts

gitea — Refactor this method to reduce its Cognitive Complexity from 17 to the 15 allowed. (CRITICAL, 7min estimated) (pkg/sentinel/collector.go:131)

Suggested fix (not applied)

Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch.

pkg/sentinel/collector.go — Replace parseUSBScratchFstab with a version whose loop only tracks the BEGIN/END marker block and delegates each in-block line to a new helper, applyUSBScratchFstabLine, which contains the unchanged entry-parsing logic. This drops parseUSBScratchFstab to complexity ~4 and the helper to ~9, both under the limit. Behaviour is identical: the original 'continue' statements after the marker cases are redundant inside a Go switch (no fallthrough), the '!inBlock || empty || comment' skip becomes the switch only dispatching when inBlock plus the helper's early return for empty/comment lines, and every
... (truncated)

func parseUSBScratchFstab(raw string) (*usbScratchConfig, bool) {
	cfg := &usbScratchConfig{}
	inBlock := false
	for _, line := range strings.Split(raw, "\n") {
		line = strings.TrimSpace(line)
		switch {
		case strings.HasPrefix(line, "# BEGIN maintenance.bstein.dev usb-scratch"):
			inBlock = true
		case strings.HasPrefix(line, "# END maintenance.bstein.dev usb-scratch"):
			inBlock = false
		case inBlock:
			applyUSBScratchFstabLine(cfg, line)
		}
	}
	if cfg.Mountpoint == "" {
		return nil, false
	}
	return cfg, true
}

func applyUSBScratchFstabLine(cfg *usbScratchConfig, line string) {
	if line == "" || strings.HasPrefix(line, "#") {
		return
	}
	fields := strings.Fields(line)
	if len(fields) < 4 {
		return
	}
	source, target, fsType, options := fields[0], fields[1], fields[2], fields[3]
	if fsType == "none" && hasFstabOption(options, "bind") {
		cfg.BindTargets = append(cfg.BindTargets, target)
		return
	}
	if fsType == "tmpfs" || strings.EqualFold(source, "tmpfs") {
		return
	}
	cfg.Mountpoint = target
	cfg.FS = fsType
	if value, ok := strings.CutPrefix(source, "UUID="); ok {
		cfg.UUID = value
	}
	if value, ok := strings.CutPrefix(source, "LABEL="); ok {
		cfg.Label = value
	}
}

Links

SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=metis&open=AZ2z_XbbKy9i4pkIqvM9
Full evidence bundle and audit trail live in Ariadne at /api/admin/audit/events, event types hermes_autotriage_incident and hermes_autotriage_diagnosis.

Filed automatically by Ariadne from a Hermes Agent diagnosis (run run_d91470d46cea45fbaa44bb3df8ae5970). Hermes has no write access to this repository; no files or infrastructure were changed.

SonarQube reports **go:S3776** in `pkg/sentinel/collector.go`. The build is green; this is a standing finding, not a failure. ## What is wrong parseUSBScratchFstab (line 131) reaches cognitive complexity 17 because the fstab-entry handling (empty/comment skip, field count check, bind detection, tmpfs skip, UUID=/LABEL= prefix parsing) is all nested inside the marker-block switch inside the line loop, so every condition pays a nesting penalty and the boolean operator chains add more. Extracting the per-entry handling into a helper removes the nesting penalties without changing behaviour. Ariadne opened no pull request for it: no automated patch was possible for this finding. ## Facts - **gitea** — Refactor this method to reduce its Cognitive Complexity from 17 to the 15 allowed. (CRITICAL, 7min estimated) (`pkg/sentinel/collector.go:131`) ## Suggested fix (not applied) Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch. **`pkg/sentinel/collector.go`** — Replace parseUSBScratchFstab with a version whose loop only tracks the BEGIN/END marker block and delegates each in-block line to a new helper, applyUSBScratchFstabLine, which contains the unchanged entry-parsing logic. This drops parseUSBScratchFstab to complexity ~4 and the helper to ~9, both under the limit. Behaviour is identical: the original 'continue' statements after the marker cases are redundant inside a Go switch (no fallthrough), the '!inBlock || empty || comment' skip becomes the switch only dispatching when inBlock plus the helper's early return for empty/comment lines, and every ... (truncated) ``` func parseUSBScratchFstab(raw string) (*usbScratchConfig, bool) { cfg := &usbScratchConfig{} inBlock := false for _, line := range strings.Split(raw, "\n") { line = strings.TrimSpace(line) switch { case strings.HasPrefix(line, "# BEGIN maintenance.bstein.dev usb-scratch"): inBlock = true case strings.HasPrefix(line, "# END maintenance.bstein.dev usb-scratch"): inBlock = false case inBlock: applyUSBScratchFstabLine(cfg, line) } } if cfg.Mountpoint == "" { return nil, false } return cfg, true } func applyUSBScratchFstabLine(cfg *usbScratchConfig, line string) { if line == "" || strings.HasPrefix(line, "#") { return } fields := strings.Fields(line) if len(fields) < 4 { return } source, target, fsType, options := fields[0], fields[1], fields[2], fields[3] if fsType == "none" && hasFstabOption(options, "bind") { cfg.BindTargets = append(cfg.BindTargets, target) return } if fsType == "tmpfs" || strings.EqualFold(source, "tmpfs") { return } cfg.Mountpoint = target cfg.FS = fsType if value, ok := strings.CutPrefix(source, "UUID="); ok { cfg.UUID = value } if value, ok := strings.CutPrefix(source, "LABEL="); ok { cfg.Label = value } } ``` ## Links - SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=metis&open=AZ2z_XbbKy9i4pkIqvM9 - Full evidence bundle and audit trail live in Ariadne at `/api/admin/audit/events`, event types `hermes_autotriage_incident` and `hermes_autotriage_diagnosis`. Filed automatically by Ariadne from a Hermes Agent diagnosis (run [run_d91470d46cea45fbaa44bb3df8ae5970](https://triage.bstein.dev/chat?resume=run_d91470d46cea45fbaa44bb3df8ae5970)). Hermes has no write access to this repository; no files or infrastructure were changed.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: titan/metis#323