[hermes] soteria: go:S1192 #36

New Issue

hermes-automation · 2026-09-23T01:33:08Z

hermes-automation commented

2026-09-23 01:33:08 +00:00

SonarQube reports go:S1192 in internal/k8s/job_manifests.go. The build is green; this is a standing finding, not a failure.

What is wrong

The literal "/cache" is duplicated in the backup and restore volume mounts and the RESTIC_CACHE_DIR environment variable. A shared constant removes this maintenance duplication without changing any generated values or runtime behavior.

Ariadne opened no pull request for it: no automated patch was possible for this finding.

Facts

gitea — Define a constant instead of duplicating this literal "/cache" 3 times. (CRITICAL, 6min estimated) (internal/k8s/job_manifests.go:45)

Suggested fix (not applied)

Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch.

internal/k8s/job_manifests.go — Add an unexported package-level constant after the imports and replace all three standalone "/cache" literals with it. Leave restoreCommand's shell string unchanged: its embedded /cache/restore paths are not the duplicated literal identified by this finding.

diff --git a/internal/k8s/job_manifests.go b/internal/k8s/job_manifests.go
--- a/internal/k8s/job_manifests.go
+++ b/internal/k8s/job_manifests.go
@@
-func buildBackupJob(cfg *config.Config, req api.BackupRequest, jobName, secretName, repository string, dedupeEnabled bool, keepLast int) *batchv1.Job {
+const resticCacheDir = "/cache"
+
+func buildBackupJob(cfg *config.Config, req api.BackupRequest, jobName, secretName, repository string, dedupeEnabled bool, keepLast int) *batchv1.Job {
@@
 					{Name: "data", MountPath: "/data", ReadOnly: true},
-					{Name: "cache", MountPath: "/cache"},
+					{Name: "cache", MountPath: resticCacheDir},
@@
 					{Name: "restore", MountPath: "/restore"},
-					{Name: "cache", MountPath: "/cache"},
+					{Name: "cache", MountPath: resticCacheDir},
@@
-		{Name: "RESTIC_CACHE_DIR", Value: "/cache"},
+		{Name: "RESTIC_CACHE_DIR", Value: resticCacheDir},

Links

SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=soteria&open=AZ9pTqVcN0JrBQvDGDs3
Full evidence bundle and audit trail live in Ariadne at /api/admin/audit/events, event types hermes_autotriage_incident and hermes_autotriage_diagnosis.

Filed automatically by Ariadne from a Hermes Agent diagnosis (run run_f6d357d9d1334129b29808f00a704d63). Hermes has no write access to this repository; no files or infrastructure were changed.

SonarQube reports **go:S1192** in `internal/k8s/job_manifests.go`. The build is green; this is a standing finding, not a failure. ## What is wrong The literal "/cache" is duplicated in the backup and restore volume mounts and the RESTIC_CACHE_DIR environment variable. A shared constant removes this maintenance duplication without changing any generated values or runtime behavior. Ariadne opened no pull request for it: no automated patch was possible for this finding. ## Facts - **gitea** — Define a constant instead of duplicating this literal "/cache" 3 times. (CRITICAL, 6min estimated) (`internal/k8s/job_manifests.go:45`) ## Suggested fix (not applied) Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch. **`internal/k8s/job_manifests.go`** — Add an unexported package-level constant after the imports and replace all three standalone "/cache" literals with it. Leave restoreCommand's shell string unchanged: its embedded /cache/restore paths are not the duplicated literal identified by this finding. ``` diff --git a/internal/k8s/job_manifests.go b/internal/k8s/job_manifests.go --- a/internal/k8s/job_manifests.go +++ b/internal/k8s/job_manifests.go @@ -func buildBackupJob(cfg *config.Config, req api.BackupRequest, jobName, secretName, repository string, dedupeEnabled bool, keepLast int) *batchv1.Job { +const resticCacheDir = "/cache" + +func buildBackupJob(cfg *config.Config, req api.BackupRequest, jobName, secretName, repository string, dedupeEnabled bool, keepLast int) *batchv1.Job { @@ {Name: "data", MountPath: "/data", ReadOnly: true}, - {Name: "cache", MountPath: "/cache"}, + {Name: "cache", MountPath: resticCacheDir}, @@ {Name: "restore", MountPath: "/restore"}, - {Name: "cache", MountPath: "/cache"}, + {Name: "cache", MountPath: resticCacheDir}, @@ - {Name: "RESTIC_CACHE_DIR", Value: "/cache"}, + {Name: "RESTIC_CACHE_DIR", Value: resticCacheDir}, ``` ## Links - SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=soteria&open=AZ9pTqVcN0JrBQvDGDs3 - Full evidence bundle and audit trail live in Ariadne at `/api/admin/audit/events`, event types `hermes_autotriage_incident` and `hermes_autotriage_diagnosis`. Filed automatically by Ariadne from a Hermes Agent diagnosis (run [run_f6d357d9d1334129b29808f00a704d63](https://triage.bstein.dev/chat?resume=run_f6d357d9d1334129b29808f00a704d63)). Hermes has no write access to this repository; no files or infrastructure were changed.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: titan/soteria#36