[hermes] metis: go:S3776 #385

New Issue

hermes-automation · 2026-10-01T10:25:30Z

hermes-automation commented

2026-10-01 10:25:30 +00:00

SonarQube reports go:S3776 in pkg/sentinel/collector.go. The build is green; this is a standing finding, not a failure.

What is wrong

collectUSBScratch mixes three concerns in one function body — mount/filesystem health checks, device identity resolution via blkid, and bind-target evaluation in a loop with a nested conditional — pushing cognitive complexity to 17 via accumulated nesting and boolean operators. Extracting the device-identity resolution and the bind-target loop into their own functions removes two of the deepest nesting contributors without changing behavior.

Ariadne opened no pull request for it: no automated patch was possible for this finding.

Facts

gitea — Refactor this method to reduce its Cognitive Complexity from 17 to the 15 allowed. (CRITICAL, 7min estimated) (pkg/sentinel/collector.go:131)

Suggested fix (not applied)

Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch.

pkg/sentinel/collector.go — Extract the device/UUID/Label resolution and blkid export logic (previously inline ifs operating on device) into resolveUSBScratchIdentity, and extract the BindTargets loop (for + nested if) into evaluateBindTargets. collectUSBScratch now just sequences three straightforward steps, dropping its cognitive complexity well under 15 while every branch and return value stays identical.

func collectUSBScratch() *facts.USBScratch {
	cfg, ok := loadNodeConfig()
	if !ok || cfg.USBScratch == nil {
		return nil
	}
	desired := cfg.USBScratch
	scratch := &facts.USBScratch{
		Mountpoint: desired.Mountpoint,
		UUID:       desired.UUID,
		Label:      desired.Label,
		FS:         desired.FS,
	}

	source, fsType, mounted := mountInfo(desired.Mountpoint)
	scratch.MountHealthy = mounted && strings.TrimSpace(source) != ""
	if scratch.MountHealthy && desired.FS != "" && fsType != "" {
		scratch.MountHealthy = strings.EqualFold(fsType, desired.FS)
	}
	if scratch.FS == "" && fsType != "" {
		scratch.FS = fsType
	}

	resolveUSBScratchIdentity(scratch, desired, source)

	if len(desired.BindTargets) > 0 {
		targets, healthy := evaluateBindTargets(desired.BindTargets, desired.Mountpoint)
		scratch.BindTargets = targets
		scratch.BindHealthy = healthy
	} else {
		scratch.BindHealthy = true
	}
	return scratch
}

func resolveUSBScratchIdentity(scratch *facts.USBScratch, desired *usbScratchConfig, source string) {
	device := source
	if device == "" && desired.UUID != "" {
		device = resolveDeviceByUUID(desired.UUID)
	}
	if device == "" && desired.Label != "" {
		device = resolveDeviceByLabel(desired.Label)
	}
	if device == "" {
		return
	}
	export := blkidExport(device)
	if desired.UUID != "" {
		scratch.UUIDHealthy = export["UUID"] == desired.UUID
	}
	if desired.Label != "" {
		scratch.LabelHealthy = export["LABEL"] == desired.Label
	}
	if scratch.FS == "" {
		scratch.FS = export["TYPE"]
	}
}

func evaluateBindTargets(targets []string, mountpoint string) ([]facts.USBBindTarget, bo
... (truncated)

Links

SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=metis&open=AZ2z_XbbKy9i4pkIqvM9
Full evidence bundle and audit trail live in Ariadne at /api/admin/audit/events, event types hermes_autotriage_incident and hermes_autotriage_diagnosis.

Filed automatically by Ariadne from a Hermes Agent diagnosis (run run_25e8d2dbc3284518b88eb87fdd4f0442). Hermes has no write access to this repository; no files or infrastructure were changed.

SonarQube reports **go:S3776** in `pkg/sentinel/collector.go`. The build is green; this is a standing finding, not a failure. ## What is wrong collectUSBScratch mixes three concerns in one function body — mount/filesystem health checks, device identity resolution via blkid, and bind-target evaluation in a loop with a nested conditional — pushing cognitive complexity to 17 via accumulated nesting and boolean operators. Extracting the device-identity resolution and the bind-target loop into their own functions removes two of the deepest nesting contributors without changing behavior. Ariadne opened no pull request for it: no automated patch was possible for this finding. ## Facts - **gitea** — Refactor this method to reduce its Cognitive Complexity from 17 to the 15 allowed. (CRITICAL, 7min estimated) (`pkg/sentinel/collector.go:131`) ## Suggested fix (not applied) Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch. **`pkg/sentinel/collector.go`** — Extract the device/UUID/Label resolution and blkid export logic (previously inline ifs operating on `device`) into resolveUSBScratchIdentity, and extract the BindTargets loop (for + nested if) into evaluateBindTargets. collectUSBScratch now just sequences three straightforward steps, dropping its cognitive complexity well under 15 while every branch and return value stays identical. ``` func collectUSBScratch() *facts.USBScratch { cfg, ok := loadNodeConfig() if !ok || cfg.USBScratch == nil { return nil } desired := cfg.USBScratch scratch := &facts.USBScratch{ Mountpoint: desired.Mountpoint, UUID: desired.UUID, Label: desired.Label, FS: desired.FS, } source, fsType, mounted := mountInfo(desired.Mountpoint) scratch.MountHealthy = mounted && strings.TrimSpace(source) != "" if scratch.MountHealthy && desired.FS != "" && fsType != "" { scratch.MountHealthy = strings.EqualFold(fsType, desired.FS) } if scratch.FS == "" && fsType != "" { scratch.FS = fsType } resolveUSBScratchIdentity(scratch, desired, source) if len(desired.BindTargets) > 0 { targets, healthy := evaluateBindTargets(desired.BindTargets, desired.Mountpoint) scratch.BindTargets = targets scratch.BindHealthy = healthy } else { scratch.BindHealthy = true } return scratch } func resolveUSBScratchIdentity(scratch *facts.USBScratch, desired *usbScratchConfig, source string) { device := source if device == "" && desired.UUID != "" { device = resolveDeviceByUUID(desired.UUID) } if device == "" && desired.Label != "" { device = resolveDeviceByLabel(desired.Label) } if device == "" { return } export := blkidExport(device) if desired.UUID != "" { scratch.UUIDHealthy = export["UUID"] == desired.UUID } if desired.Label != "" { scratch.LabelHealthy = export["LABEL"] == desired.Label } if scratch.FS == "" { scratch.FS = export["TYPE"] } } func evaluateBindTargets(targets []string, mountpoint string) ([]facts.USBBindTarget, bo ... (truncated) ``` ## Links - SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=metis&open=AZ2z_XbbKy9i4pkIqvM9 - Full evidence bundle and audit trail live in Ariadne at `/api/admin/audit/events`, event types `hermes_autotriage_incident` and `hermes_autotriage_diagnosis`. Filed automatically by Ariadne from a Hermes Agent diagnosis (run [run_25e8d2dbc3284518b88eb87fdd4f0442](https://triage.bstein.dev/chat?resume=run_25e8d2dbc3284518b88eb87fdd4f0442)). Hermes has no write access to this repository; no files or infrastructure were changed.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: titan/metis#385