[hermes] soteria: go:S1192 #49

New Issue

hermes-automation · 2026-09-26T19:30:21Z

hermes-automation commented

2026-09-26 19:30:21 +00:00

SonarQube reports go:S1192 in internal/k8s/job_manifests.go. The build is green; this is a standing finding, not a failure.

What is wrong

The string literal "/cache" is duplicated three times in internal/k8s/job_manifests.go: as the cache VolumeMount path in buildBackupJob, as the cache VolumeMount path in buildRestoreJob, and as the RESTIC_CACHE_DIR value in resticEnv. These three occurrences must stay in sync (restic writes its cache to RESTIC_CACHE_DIR, which must be the emptyDir mount path), so they should share one named constant.

Ariadne opened no pull request for it: no automated patch was possible for this finding.

Facts

gitea — Define a constant instead of duplicating this literal "/cache" 3 times. (CRITICAL, 6min estimated) (internal/k8s/job_manifests.go:45)

Suggested fix (not applied)

Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch.

internal/k8s/job_manifests.go — Introduce a package-level constant for the cache mount path and use it at all three sites. Add the const after the import block, then replace the literal in the buildBackupJob VolumeMounts, the buildRestoreJob VolumeMounts, and the RESTIC_CACHE_DIR env var in resticEnv. Behaviour is unchanged: the constant has exactly the same value, and the shell commands in restoreCommand that reference /cache/restore are left as-is (they use the longer literal "/cache/restore", which the rule does not flag).

const cacheMountPath = "/cache"

// In buildBackupJob:
				VolumeMounts: []corev1.VolumeMount{
					{Name: "data", MountPath: "/data", ReadOnly: true},
					{Name: "cache", MountPath: cacheMountPath},
				},

// In buildRestoreJob:
				VolumeMounts: []corev1.VolumeMount{
					{Name: "restore", MountPath: "/restore"},
					{Name: "cache", MountPath: cacheMountPath},
				},

// In resticEnv:
		{Name: "RESTIC_CACHE_DIR", Value: cacheMountPath},

Links

SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=soteria&open=AZ9pTqVcN0JrBQvDGDs3
Full evidence bundle and audit trail live in Ariadne at /api/admin/audit/events, event types hermes_autotriage_incident and hermes_autotriage_diagnosis.

Filed automatically by Ariadne from a Hermes Agent diagnosis (run run_8c11c148b87f438caeb17585d8d2ede6). Hermes has no write access to this repository; no files or infrastructure were changed.

SonarQube reports **go:S1192** in `internal/k8s/job_manifests.go`. The build is green; this is a standing finding, not a failure. ## What is wrong The string literal "/cache" is duplicated three times in internal/k8s/job_manifests.go: as the cache VolumeMount path in buildBackupJob, as the cache VolumeMount path in buildRestoreJob, and as the RESTIC_CACHE_DIR value in resticEnv. These three occurrences must stay in sync (restic writes its cache to RESTIC_CACHE_DIR, which must be the emptyDir mount path), so they should share one named constant. Ariadne opened no pull request for it: no automated patch was possible for this finding. ## Facts - **gitea** — Define a constant instead of duplicating this literal "/cache" 3 times. (CRITICAL, 6min estimated) (`internal/k8s/job_manifests.go:45`) ## Suggested fix (not applied) Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch. **`internal/k8s/job_manifests.go`** — Introduce a package-level constant for the cache mount path and use it at all three sites. Add the const after the import block, then replace the literal in the buildBackupJob VolumeMounts, the buildRestoreJob VolumeMounts, and the RESTIC_CACHE_DIR env var in resticEnv. Behaviour is unchanged: the constant has exactly the same value, and the shell commands in restoreCommand that reference /cache/restore are left as-is (they use the longer literal "/cache/restore", which the rule does not flag). ``` const cacheMountPath = "/cache" // In buildBackupJob: VolumeMounts: []corev1.VolumeMount{ {Name: "data", MountPath: "/data", ReadOnly: true}, {Name: "cache", MountPath: cacheMountPath}, }, // In buildRestoreJob: VolumeMounts: []corev1.VolumeMount{ {Name: "restore", MountPath: "/restore"}, {Name: "cache", MountPath: cacheMountPath}, }, // In resticEnv: {Name: "RESTIC_CACHE_DIR", Value: cacheMountPath}, ``` ## Links - SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=soteria&open=AZ9pTqVcN0JrBQvDGDs3 - Full evidence bundle and audit trail live in Ariadne at `/api/admin/audit/events`, event types `hermes_autotriage_incident` and `hermes_autotriage_diagnosis`. Filed automatically by Ariadne from a Hermes Agent diagnosis (run [run_8c11c148b87f438caeb17585d8d2ede6](https://triage.bstein.dev/chat?resume=run_8c11c148b87f438caeb17585d8d2ede6)). Hermes has no write access to this repository; no files or infrastructure were changed.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: titan/soteria#49