[hermes] metis: go:S3776 #387

New Issue

hermes-automation · 2026-10-25T11:27:07Z

hermes-automation commented

2026-10-25 11:27:07 +00:00

SonarQube reports go:S3776 in pkg/sentinel/collector.go. The build is green; this is a standing finding, not a failure.

What is wrong

parseUSBScratchFstab combines managed-block scanning with entry parsing, causing nested branching that exceeds the cognitive-complexity limit of 15. This is a maintainability finding, not evidence of incorrect runtime behavior.

Ariadne opened no pull request for it: no automated patch was possible for this finding.

Facts

gitea — Refactor this method to reduce its Cognitive Complexity from 17 to the 15 allowed. (CRITICAL, 7min estimated) (pkg/sentinel/collector.go:131)

Suggested fix (not applied)

Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch.

pkg/sentinel/collector.go — Replace parseUSBScratchFstab with the version below and add the helper alongside it. Extracting entry parsing removes its branches from the scanning loop, bringing both functions below the limit. This preserves marker handling, malformed-entry rejection, bind-target ordering, bind-before-tmpfs precedence, last-mount assignment, retained UUID/label values, and the nil/false result when the final mountpoint is empty.

func parseUSBScratchFstab(raw string) (*usbScratchConfig, bool) {
	cfg := &usbScratchConfig{}
	inBlock := false
	for _, line := range strings.Split(raw, "\n") {
		line = strings.TrimSpace(line)
		switch {
		case strings.HasPrefix(line, "# BEGIN maintenance.bstein.dev usb-scratch"):
			inBlock = true
			continue
		case strings.HasPrefix(line, "# END maintenance.bstein.dev usb-scratch"):
			inBlock = false
			continue
		case !inBlock || line == "" || strings.HasPrefix(line, "#"):
			continue
		}
		parseUSBScratchFstabEntry(line, cfg)
	}
	if cfg.Mountpoint == "" {
		return nil, false
	}
	return cfg, true
}

func parseUSBScratchFstabEntry(line string, cfg *usbScratchConfig) {
	fields := strings.Fields(line)
	if len(fields) < 4 {
		return
	}
	source, target, fsType, options := fields[0], fields[1], fields[2], fields[3]
	if fsType == "none" && hasFstabOption(options, "bind") {
		cfg.BindTargets = append(cfg.BindTargets, target)
		return
	}
	if fsType == "tmpfs" || strings.EqualFold(source, "tmpfs") {
		return
	}
	cfg.Mountpoint = target
	cfg.FS = fsType
	if value, ok := strings.CutPrefix(source, "UUID="); ok {
		cfg.UUID = value
	}
	if value, ok := strings.CutPrefix(source, "LABEL="); ok {
		cfg.Label = value
	}
}

Links

SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=metis&open=AZ2z_XbbKy9i4pkIqvM9
Full evidence bundle and audit trail live in Ariadne at /api/admin/audit/events, event types hermes_autotriage_incident and hermes_autotriage_diagnosis.

Filed automatically by Ariadne from a Hermes Agent diagnosis (run run_cc1d4f613bdf4463b8733353366f7983). Hermes has no write access to this repository; no files or infrastructure were changed.

SonarQube reports **go:S3776** in `pkg/sentinel/collector.go`. The build is green; this is a standing finding, not a failure. ## What is wrong parseUSBScratchFstab combines managed-block scanning with entry parsing, causing nested branching that exceeds the cognitive-complexity limit of 15. This is a maintainability finding, not evidence of incorrect runtime behavior. Ariadne opened no pull request for it: no automated patch was possible for this finding. ## Facts - **gitea** — Refactor this method to reduce its Cognitive Complexity from 17 to the 15 allowed. (CRITICAL, 7min estimated) (`pkg/sentinel/collector.go:131`) ## Suggested fix (not applied) Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch. **`pkg/sentinel/collector.go`** — Replace parseUSBScratchFstab with the version below and add the helper alongside it. Extracting entry parsing removes its branches from the scanning loop, bringing both functions below the limit. This preserves marker handling, malformed-entry rejection, bind-target ordering, bind-before-tmpfs precedence, last-mount assignment, retained UUID/label values, and the nil/false result when the final mountpoint is empty. ``` func parseUSBScratchFstab(raw string) (*usbScratchConfig, bool) { cfg := &usbScratchConfig{} inBlock := false for _, line := range strings.Split(raw, "\n") { line = strings.TrimSpace(line) switch { case strings.HasPrefix(line, "# BEGIN maintenance.bstein.dev usb-scratch"): inBlock = true continue case strings.HasPrefix(line, "# END maintenance.bstein.dev usb-scratch"): inBlock = false continue case !inBlock || line == "" || strings.HasPrefix(line, "#"): continue } parseUSBScratchFstabEntry(line, cfg) } if cfg.Mountpoint == "" { return nil, false } return cfg, true } func parseUSBScratchFstabEntry(line string, cfg *usbScratchConfig) { fields := strings.Fields(line) if len(fields) < 4 { return } source, target, fsType, options := fields[0], fields[1], fields[2], fields[3] if fsType == "none" && hasFstabOption(options, "bind") { cfg.BindTargets = append(cfg.BindTargets, target) return } if fsType == "tmpfs" || strings.EqualFold(source, "tmpfs") { return } cfg.Mountpoint = target cfg.FS = fsType if value, ok := strings.CutPrefix(source, "UUID="); ok { cfg.UUID = value } if value, ok := strings.CutPrefix(source, "LABEL="); ok { cfg.Label = value } } ``` ## Links - SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=metis&open=AZ2z_XbbKy9i4pkIqvM9 - Full evidence bundle and audit trail live in Ariadne at `/api/admin/audit/events`, event types `hermes_autotriage_incident` and `hermes_autotriage_diagnosis`. Filed automatically by Ariadne from a Hermes Agent diagnosis (run [run_cc1d4f613bdf4463b8733353366f7983](https://triage.bstein.dev/chat?resume=run_cc1d4f613bdf4463b8733353366f7983)). Hermes has no write access to this repository; no files or infrastructure were changed.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: titan/metis#387