[hermes] pegasus: go:S3776 #31

New Issue

hermes-automation · 2026-09-27T09:42:05Z

hermes-automation commented

2026-09-27 09:42:05 +00:00

SonarQube reports go:S3776 in backend/uploads.go. The build is green; this is a standing finding, not a failure.

What is wrong

sanitizeDescriptor (backend/uploads.go, line 21) has a cognitive complexity of 16, one over the allowed 15. The largest single contributor is the five-clause boolean expression that classifies each rune, which adds 4 points on top of the nested underscore-collapsing branches inside the loop.

Ariadne opened no pull request for it: no automated patch was possible for this finding.

Facts

gitea — Refactor this method to reduce its Cognitive Complexity from 16 to the 15 allowed. (CRITICAL, 6min estimated) (backend/uploads.go:21)

Suggested fix (not applied)

Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch.

backend/uploads.go — The chained (r >= 'a' && r <= 'z') || ... expression contributes 4 complexity points to sanitizeDescriptor. Extracting that predicate into a named helper drops the function from 16 to 12 while keeping behaviour identical: disallowed runes still become '_', consecutive underscores are still collapsed, the empty-input fallback to "upload" is untouched, and the 64-rune cap still applies (its mis-indented block is only re-indented, not changed). Replace the existing sanitizeDescriptor with the code below.

func isAllowedDescriptorRune(r rune) bool {
	return (r >= 'a' && r <= 'z') || (r >= 'A' && r <= 'Z') ||
		(r >= '0' && r <= '9') || r == '_' || r == '-'
}

func sanitizeDescriptor(s string) string {
	s = strings.TrimSpace(s)
	s = strings.ReplaceAll(s, " ", "_")
	if s == "" {
		return "upload"
	}

	var b []rune
	lastUnderscore := false
	for _, r := range s {
		if !isAllowedDescriptorRune(r) {
			r = '_'
		}
		if r == '_' {
			if lastUnderscore {
				continue
			}
			lastUnderscore = true
		} else {
			lastUnderscore = false
		}
		b = append(b, r)
		if len(b) >= 64 {
			break
		}
	}
	return string(b)
}

Links

SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=pegasus&open=AZ4V2tkdqCRMjDT4bXBr
Full evidence bundle and audit trail live in Ariadne at /api/admin/audit/events, event types hermes_autotriage_incident and hermes_autotriage_diagnosis.

Filed automatically by Ariadne from a Hermes Agent diagnosis (run run_818ed3e3af9544b7a031ffa2b503f004). Hermes has no write access to this repository; no files or infrastructure were changed.

SonarQube reports **go:S3776** in `backend/uploads.go`. The build is green; this is a standing finding, not a failure. ## What is wrong sanitizeDescriptor (backend/uploads.go, line 21) has a cognitive complexity of 16, one over the allowed 15. The largest single contributor is the five-clause boolean expression that classifies each rune, which adds 4 points on top of the nested underscore-collapsing branches inside the loop. Ariadne opened no pull request for it: no automated patch was possible for this finding. ## Facts - **gitea** — Refactor this method to reduce its Cognitive Complexity from 16 to the 15 allowed. (CRITICAL, 6min estimated) (`backend/uploads.go:21`) ## Suggested fix (not applied) Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch. **`backend/uploads.go`** — The chained (r >= 'a' && r <= 'z') || ... expression contributes 4 complexity points to sanitizeDescriptor. Extracting that predicate into a named helper drops the function from 16 to 12 while keeping behaviour identical: disallowed runes still become '_', consecutive underscores are still collapsed, the empty-input fallback to "upload" is untouched, and the 64-rune cap still applies (its mis-indented block is only re-indented, not changed). Replace the existing sanitizeDescriptor with the code below. ``` func isAllowedDescriptorRune(r rune) bool { return (r >= 'a' && r <= 'z') || (r >= 'A' && r <= 'Z') || (r >= '0' && r <= '9') || r == '_' || r == '-' } func sanitizeDescriptor(s string) string { s = strings.TrimSpace(s) s = strings.ReplaceAll(s, " ", "_") if s == "" { return "upload" } var b []rune lastUnderscore := false for _, r := range s { if !isAllowedDescriptorRune(r) { r = '_' } if r == '_' { if lastUnderscore { continue } lastUnderscore = true } else { lastUnderscore = false } b = append(b, r) if len(b) >= 64 { break } } return string(b) } ``` ## Links - SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=pegasus&open=AZ4V2tkdqCRMjDT4bXBr - Full evidence bundle and audit trail live in Ariadne at `/api/admin/audit/events`, event types `hermes_autotriage_incident` and `hermes_autotriage_diagnosis`. Filed automatically by Ariadne from a Hermes Agent diagnosis (run [run_818ed3e3af9544b7a031ffa2b503f004](https://triage.bstein.dev/chat?resume=run_818ed3e3af9544b7a031ffa2b503f004)). Hermes has no write access to this repository; no files or infrastructure were changed.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: titan/pegasus#31