[hermes] soteria: go:S1192 #64

New Issue

hermes-automation · 2026-09-29T02:28:57Z

hermes-automation commented

2026-09-29 02:28:57 +00:00

SonarQube reports go:S1192 in internal/k8s/job_manifests.go. The build is green; this is a standing finding, not a failure.

What is wrong

The string literal "/cache" is duplicated three times in internal/k8s/job_manifests.go: as the cache volume mount path in buildBackupJob and buildRestoreJob, and as the RESTIC_CACHE_DIR value in resticEnv. These three sites must stay in sync (the env var only works because it matches the mount path), so Sonar's go:S1192 correctly asks for a single named constant.

Ariadne opened no pull request for it: no automated patch was possible for this finding.

Facts

gitea — Define a constant instead of duplicating this literal "/cache" 3 times. (CRITICAL, 6min estimated) (internal/k8s/job_manifests.go:45)

Suggested fix (not applied)

Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch.

internal/k8s/job_manifests.go — Introduce one package-level constant for the restic cache directory and use it at all three duplicated sites. This removes the duplication S1192 flags and makes the coupling between the volume mount path and RESTIC_CACHE_DIR explicit, without changing any generated manifest. Add the constant near the top of the file (after the imports), then replace the three "/cache" literals as shown.

// Add after the import block:
const resticCacheDir = "/cache"

// In buildBackupJob, container VolumeMounts:
VolumeMounts: []corev1.VolumeMount{
	{Name: "data", MountPath: "/data", ReadOnly: true},
	{Name: "cache", MountPath: resticCacheDir},
},

// In buildRestoreJob, container VolumeMounts:
VolumeMounts: []corev1.VolumeMount{
	{Name: "restore", MountPath: "/restore"},
	{Name: "cache", MountPath: resticCacheDir},
},

// In resticEnv:
{Name: "RESTIC_CACHE_DIR", Value: resticCacheDir},

Links

SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=soteria&open=AZ9pTqVcN0JrBQvDGDs3
Full evidence bundle and audit trail live in Ariadne at /api/admin/audit/events, event types hermes_autotriage_incident and hermes_autotriage_diagnosis.

Filed automatically by Ariadne from a Hermes Agent diagnosis (run run_19014e35f9a54395b87e64c1f8d4572a). Hermes has no write access to this repository; no files or infrastructure were changed.

SonarQube reports **go:S1192** in `internal/k8s/job_manifests.go`. The build is green; this is a standing finding, not a failure. ## What is wrong The string literal "/cache" is duplicated three times in internal/k8s/job_manifests.go: as the cache volume mount path in buildBackupJob and buildRestoreJob, and as the RESTIC_CACHE_DIR value in resticEnv. These three sites must stay in sync (the env var only works because it matches the mount path), so Sonar's go:S1192 correctly asks for a single named constant. Ariadne opened no pull request for it: no automated patch was possible for this finding. ## Facts - **gitea** — Define a constant instead of duplicating this literal "/cache" 3 times. (CRITICAL, 6min estimated) (`internal/k8s/job_manifests.go:45`) ## Suggested fix (not applied) Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch. **`internal/k8s/job_manifests.go`** — Introduce one package-level constant for the restic cache directory and use it at all three duplicated sites. This removes the duplication S1192 flags and makes the coupling between the volume mount path and RESTIC_CACHE_DIR explicit, without changing any generated manifest. Add the constant near the top of the file (after the imports), then replace the three "/cache" literals as shown. ``` // Add after the import block: const resticCacheDir = "/cache" // In buildBackupJob, container VolumeMounts: VolumeMounts: []corev1.VolumeMount{ {Name: "data", MountPath: "/data", ReadOnly: true}, {Name: "cache", MountPath: resticCacheDir}, }, // In buildRestoreJob, container VolumeMounts: VolumeMounts: []corev1.VolumeMount{ {Name: "restore", MountPath: "/restore"}, {Name: "cache", MountPath: resticCacheDir}, }, // In resticEnv: {Name: "RESTIC_CACHE_DIR", Value: resticCacheDir}, ``` ## Links - SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=soteria&open=AZ9pTqVcN0JrBQvDGDs3 - Full evidence bundle and audit trail live in Ariadne at `/api/admin/audit/events`, event types `hermes_autotriage_incident` and `hermes_autotriage_diagnosis`. Filed automatically by Ariadne from a Hermes Agent diagnosis (run [run_19014e35f9a54395b87e64c1f8d4572a](https://triage.bstein.dev/chat?resume=run_19014e35f9a54395b87e64c1f8d4572a)). Hermes has no write access to this repository; no files or infrastructure were changed.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: titan/soteria#64