[hermes] soteria: go:S3776 #56

New Issue

hermes-automation · 2026-09-27T10:33:22Z

hermes-automation commented

2026-09-27 10:33:22 +00:00

SonarQube reports go:S3776 in internal/server/metrics.go. The build is green; this is a standing finding, not a failure.

What is wrong

RecordInventory nests per-PVC conditional logic (reason fallback, health flag, last-backup guards) two loops deep, pushing its cognitive complexity to 16, one over the allowed 15. Extracting the per-PVC body into a helper removes the nesting penalties without changing behaviour.

Ariadne opened no pull request for it: no automated patch was possible for this finding.

Facts

gitea — Refactor this method to reduce its Cognitive Complexity from 16 to the 15 allowed. (CRITICAL, 6min estimated) (internal/server/metrics.go:133)

Suggested fix (not applied)

Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch.

internal/server/metrics.go — The double loop plus the four conditionals inside it accumulate nesting increments that exceed the threshold. Move the per-PVC work into a private helper called from the inner loop; the loops keep the lock and reset logic, while the helper holds the straight-line conditionals at top level, dropping complexity well under 15. Behaviour is identical: the Healthy if/else collapses to a value pre-set to 0 and flipped to 1, and the LastBackupAt continue becomes an early return. Note: adjust the helper's parameter type (shown as api.PVCInventory) to the actual element type of namespace.PVCs in the ap
... (truncated)

// RecordInventory updates PVC backup metrics from the latest inventory snapshot.
func (t *telemetry) RecordInventory(inv api.InventoryResponse) {
	t.mu.Lock()
	defer t.mu.Unlock()

	t.pvcBackupAgeHours = map[string]metricSample{}
	t.pvcBackupHealth = map[string]metricSample{}
	t.pvcBackupHealthReason = map[string]metricSample{}
	t.pvcBackupLastSuccess = map[string]metricSample{}
	t.pvcBackupCount = map[string]metricSample{}
	t.pvcBackupCompletedCount = map[string]metricSample{}
	t.pvcBackupLastSizeBytes = map[string]metricSample{}
	t.pvcBackupTotalSizeBytes = map[string]metricSample{}

	for _, namespace := range inv.Namespaces {
		for _, pvc := range namespace.PVCs {
			t.recordPVCInventory(pvc)
		}
	}

	t.inventoryRefreshTime = float64(time.Now().Unix())
}

// recordPVCInventory records backup metrics for a single PVC.
// The caller must hold t.mu.
func (t *telemetry) recordPVCInventory(pvc api.PVCInventory) {
	labels := map[string]string{
		"namespace": pvc.Namespace,
		"pvc":       pvc.PVC,
		"volume":    pvc.Volume,
		"driver":    pvc.Driver,
	}
	setMetric(t.pvcBackupCount, labels, float64(pvc.BackupCount))
	setMetric(t.pvcBackupCompletedCount, labels, float64(pvc.CompletedBackups))
	setMetric(t.pvcBackupLastSizeBytes, labels, pvc.LastBackupSizeBytes)
	setMetric(t.pvcBackupTotalSizeBytes, labels, pvc.TotalBackupSizeBytes)
	reasonLabels := cloneLabels(labels)
	reason := strings.TrimSpace(pvc.HealthReason)
	if reason == "" {
		reason = "unknown"
	}
	reasonLabels["reason"] = reason
	setMetric(t.pvcBackupHealthReason, reasonLabels, 1)
	health := float64(0)
	if pvc.Healthy
... (truncated)

Links

SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=soteria&open=AZ4WREVmqCRMjDT4bXbu
Full evidence bundle and audit trail live in Ariadne at /api/admin/audit/events, event types hermes_autotriage_incident and hermes_autotriage_diagnosis.

Filed automatically by Ariadne from a Hermes Agent diagnosis (run run_94129e3ec37c44fb9c7a6bc5f8ce51d3). Hermes has no write access to this repository; no files or infrastructure were changed.

SonarQube reports **go:S3776** in `internal/server/metrics.go`. The build is green; this is a standing finding, not a failure. ## What is wrong RecordInventory nests per-PVC conditional logic (reason fallback, health flag, last-backup guards) two loops deep, pushing its cognitive complexity to 16, one over the allowed 15. Extracting the per-PVC body into a helper removes the nesting penalties without changing behaviour. Ariadne opened no pull request for it: no automated patch was possible for this finding. ## Facts - **gitea** — Refactor this method to reduce its Cognitive Complexity from 16 to the 15 allowed. (CRITICAL, 6min estimated) (`internal/server/metrics.go:133`) ## Suggested fix (not applied) Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch. **`internal/server/metrics.go`** — The double loop plus the four conditionals inside it accumulate nesting increments that exceed the threshold. Move the per-PVC work into a private helper called from the inner loop; the loops keep the lock and reset logic, while the helper holds the straight-line conditionals at top level, dropping complexity well under 15. Behaviour is identical: the Healthy if/else collapses to a value pre-set to 0 and flipped to 1, and the LastBackupAt continue becomes an early return. Note: adjust the helper's parameter type (shown as api.PVCInventory) to the actual element type of namespace.PVCs in the ap ... (truncated) ``` // RecordInventory updates PVC backup metrics from the latest inventory snapshot. func (t *telemetry) RecordInventory(inv api.InventoryResponse) { t.mu.Lock() defer t.mu.Unlock() t.pvcBackupAgeHours = map[string]metricSample{} t.pvcBackupHealth = map[string]metricSample{} t.pvcBackupHealthReason = map[string]metricSample{} t.pvcBackupLastSuccess = map[string]metricSample{} t.pvcBackupCount = map[string]metricSample{} t.pvcBackupCompletedCount = map[string]metricSample{} t.pvcBackupLastSizeBytes = map[string]metricSample{} t.pvcBackupTotalSizeBytes = map[string]metricSample{} for _, namespace := range inv.Namespaces { for _, pvc := range namespace.PVCs { t.recordPVCInventory(pvc) } } t.inventoryRefreshTime = float64(time.Now().Unix()) } // recordPVCInventory records backup metrics for a single PVC. // The caller must hold t.mu. func (t *telemetry) recordPVCInventory(pvc api.PVCInventory) { labels := map[string]string{ "namespace": pvc.Namespace, "pvc": pvc.PVC, "volume": pvc.Volume, "driver": pvc.Driver, } setMetric(t.pvcBackupCount, labels, float64(pvc.BackupCount)) setMetric(t.pvcBackupCompletedCount, labels, float64(pvc.CompletedBackups)) setMetric(t.pvcBackupLastSizeBytes, labels, pvc.LastBackupSizeBytes) setMetric(t.pvcBackupTotalSizeBytes, labels, pvc.TotalBackupSizeBytes) reasonLabels := cloneLabels(labels) reason := strings.TrimSpace(pvc.HealthReason) if reason == "" { reason = "unknown" } reasonLabels["reason"] = reason setMetric(t.pvcBackupHealthReason, reasonLabels, 1) health := float64(0) if pvc.Healthy ... (truncated) ``` ## Links - SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=soteria&open=AZ4WREVmqCRMjDT4bXbu - Full evidence bundle and audit trail live in Ariadne at `/api/admin/audit/events`, event types `hermes_autotriage_incident` and `hermes_autotriage_diagnosis`. Filed automatically by Ariadne from a Hermes Agent diagnosis (run [run_94129e3ec37c44fb9c7a6bc5f8ce51d3](https://triage.bstein.dev/chat?resume=run_94129e3ec37c44fb9c7a6bc5f8ce51d3)). Hermes has no write access to this repository; no files or infrastructure were changed.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: titan/soteria#56