[hermes] pegasus: go:S3776 #1

New Issue

bstein · 2026-08-08T19:18:57Z

bstein commented

2026-08-08 19:18:57 +00:00

SonarQube reports go:S3776 in backend/uploads.go. The build is green; this is a standing finding, not a failure.

What is wrong

moveFromTus combines source-file discovery, directory preparation, dry-run handling, and rename/copy fallback, which pushes its Cognitive Complexity just over Sonar's threshold. Extracting the source-file lookup preserves all existing lookup order and error handling while reducing the method's complexity.

Ariadne opened no pull request for it: no automated patch was possible for this finding.

Facts

gitea — Refactor this method to reduce its Cognitive Complexity from 16 to the 15 allowed. (CRITICAL, 6min estimated) (backend/uploads.go:21)

Suggested fix (not applied)

Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch.

backend/uploads.go — Move the candidate-path and directory-scan logic into a helper. This keeps the same candidate order, regular-file check, prefix fallback, and ignored ReadDir error, while making moveFromTus responsible only for moving a source that was found.

func findTusDataFile(uploadID string) string {
	candidates := []string{
		filepath.Join(tusDir, uploadID),
		filepath.Join(tusDir, uploadID+".bin"),
		filepath.Join(tusDir, "data", uploadID),
		filepath.Join(tusDir, "data", uploadID+".bin"),
		filepath.Join(tusDir, "uploads", uploadID),
		filepath.Join(tusDir, "uploads", uploadID+".bin"),
	}

	for _, p := range candidates {
		if fi, err := os.Stat(p); err == nil && fi.Mode().IsRegular() {
			return p
		}
	}

	entries, _ := os.ReadDir(tusDir)
	for _, e := range entries {
		if !e.IsDir() && strings.HasPrefix(e.Name(), uploadID) {
			return filepath.Join(tusDir, e.Name())
		}
	}

	return ""
}

func moveFromTus(ev handler.HookEvent, dst string) error {
	src := findTusDataFile(ev.Upload.ID)
	if src == "" {
		return fmt.Errorf("tus data file not found for id %s", ev.Upload.ID)
	}

	// Keep the remainder of moveFromTus unchanged.
}

Links

SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=pegasus&open=AZ4V2tkdqCRMjDT4bXBr
Full evidence bundle and audit trail live in Ariadne at /api/admin/audit/events, event types hermes_autotriage_incident and hermes_autotriage_diagnosis.

Filed automatically by Ariadne from a Hermes Agent diagnosis (run run_db1850794c444570b183b994f6ccff3f). Hermes has no write access to this repository; no files or infrastructure were changed.

SonarQube reports **go:S3776** in `backend/uploads.go`. The build is green; this is a standing finding, not a failure. ## What is wrong moveFromTus combines source-file discovery, directory preparation, dry-run handling, and rename/copy fallback, which pushes its Cognitive Complexity just over Sonar's threshold. Extracting the source-file lookup preserves all existing lookup order and error handling while reducing the method's complexity. Ariadne opened no pull request for it: no automated patch was possible for this finding. ## Facts - **gitea** — Refactor this method to reduce its Cognitive Complexity from 16 to the 15 allowed. (CRITICAL, 6min estimated) (`backend/uploads.go:21`) ## Suggested fix (not applied) Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch. **`backend/uploads.go`** — Move the candidate-path and directory-scan logic into a helper. This keeps the same candidate order, regular-file check, prefix fallback, and ignored ReadDir error, while making moveFromTus responsible only for moving a source that was found. ``` func findTusDataFile(uploadID string) string { candidates := []string{ filepath.Join(tusDir, uploadID), filepath.Join(tusDir, uploadID+".bin"), filepath.Join(tusDir, "data", uploadID), filepath.Join(tusDir, "data", uploadID+".bin"), filepath.Join(tusDir, "uploads", uploadID), filepath.Join(tusDir, "uploads", uploadID+".bin"), } for _, p := range candidates { if fi, err := os.Stat(p); err == nil && fi.Mode().IsRegular() { return p } } entries, _ := os.ReadDir(tusDir) for _, e := range entries { if !e.IsDir() && strings.HasPrefix(e.Name(), uploadID) { return filepath.Join(tusDir, e.Name()) } } return "" } func moveFromTus(ev handler.HookEvent, dst string) error { src := findTusDataFile(ev.Upload.ID) if src == "" { return fmt.Errorf("tus data file not found for id %s", ev.Upload.ID) } // Keep the remainder of moveFromTus unchanged. } ``` ## Links - SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=pegasus&open=AZ4V2tkdqCRMjDT4bXBr - Full evidence bundle and audit trail live in Ariadne at `/api/admin/audit/events`, event types `hermes_autotriage_incident` and `hermes_autotriage_diagnosis`. Filed automatically by Ariadne from a Hermes Agent diagnosis (run [run_db1850794c444570b183b994f6ccff3f](https://agent.bstein.dev/chat?resume=run_db1850794c444570b183b994f6ccff3f)). Hermes has no write access to this repository; no files or infrastructure were changed.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: titan/pegasus#1