[hermes] soteria: go:S1192 #69

New Issue

hermes-automation · 2026-09-30T04:27:06Z

hermes-automation commented

2026-09-30 04:27:06 +00:00

SonarQube reports go:S1192 in internal/k8s/job_manifests.go. The build is green; this is a standing finding, not a failure.

What is wrong

The string literal "/cache" is duplicated three times in internal/k8s/job_manifests.go: as the cache VolumeMount path in buildBackupJob (line 45), as the cache VolumeMount path in buildRestoreJob, and as the RESTIC_CACHE_DIR value in resticEnv. If the cache mount point ever changes, all three sites must be updated in lockstep or the restic cache silently stops working, which is exactly the drift risk go:S1192 flags.

Ariadne opened no pull request for it: no automated patch was possible for this finding.

Facts

gitea — Define a constant instead of duplicating this literal "/cache" 3 times. (CRITICAL, 6min estimated) (internal/k8s/job_manifests.go:45)

Suggested fix (not applied)

Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch.

internal/k8s/job_manifests.go — Define a package-level constant for the restic cache mount path and use it at all three sites. The mount path and RESTIC_CACHE_DIR must always agree (restic writes its cache to the directory named by RESTIC_CACHE_DIR, which only persists because the emptyDir volume is mounted at that same path), so a single constant both satisfies the rule and encodes that real coupling. Behaviour is unchanged: the constant has the identical value "/cache". Note the "/cache/restore" paths inside the restoreCommand shell string are part of a different, larger literal and are not flagged; they can be left as-is.

// Add near the top of the file, after the imports:

// resticCacheDir is where the restic cache emptyDir is mounted; it must
// match the RESTIC_CACHE_DIR environment variable passed to restic.
const resticCacheDir = "/cache"

// In buildBackupJob, replace the VolumeMounts entry:
				VolumeMounts: []corev1.VolumeMount{
					{Name: "data", MountPath: "/data", ReadOnly: true},
					{Name: "cache", MountPath: resticCacheDir},
				},

// In buildRestoreJob, replace the VolumeMounts entry:
				VolumeMounts: []corev1.VolumeMount{
					{Name: "restore", MountPath: "/restore"},
					{Name: "cache", MountPath: resticCacheDir},
				},

// In resticEnv, replace the RESTIC_CACHE_DIR entry:
		{Name: "RESTIC_CACHE_DIR", Value: resticCacheDir},

Links

SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=soteria&open=AZ9pTqVcN0JrBQvDGDs3
Full evidence bundle and audit trail live in Ariadne at /api/admin/audit/events, event types hermes_autotriage_incident and hermes_autotriage_diagnosis.

Filed automatically by Ariadne from a Hermes Agent diagnosis (run run_73eda560dd3f4b90a31118cec4a4f664). Hermes has no write access to this repository; no files or infrastructure were changed.

SonarQube reports **go:S1192** in `internal/k8s/job_manifests.go`. The build is green; this is a standing finding, not a failure. ## What is wrong The string literal "/cache" is duplicated three times in internal/k8s/job_manifests.go: as the cache VolumeMount path in buildBackupJob (line 45), as the cache VolumeMount path in buildRestoreJob, and as the RESTIC_CACHE_DIR value in resticEnv. If the cache mount point ever changes, all three sites must be updated in lockstep or the restic cache silently stops working, which is exactly the drift risk go:S1192 flags. Ariadne opened no pull request for it: no automated patch was possible for this finding. ## Facts - **gitea** — Define a constant instead of duplicating this literal "/cache" 3 times. (CRITICAL, 6min estimated) (`internal/k8s/job_manifests.go:45`) ## Suggested fix (not applied) Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch. **`internal/k8s/job_manifests.go`** — Define a package-level constant for the restic cache mount path and use it at all three sites. The mount path and RESTIC_CACHE_DIR must always agree (restic writes its cache to the directory named by RESTIC_CACHE_DIR, which only persists because the emptyDir volume is mounted at that same path), so a single constant both satisfies the rule and encodes that real coupling. Behaviour is unchanged: the constant has the identical value "/cache". Note the "/cache/restore" paths inside the restoreCommand shell string are part of a different, larger literal and are not flagged; they can be left as-is. ``` // Add near the top of the file, after the imports: // resticCacheDir is where the restic cache emptyDir is mounted; it must // match the RESTIC_CACHE_DIR environment variable passed to restic. const resticCacheDir = "/cache" // In buildBackupJob, replace the VolumeMounts entry: VolumeMounts: []corev1.VolumeMount{ {Name: "data", MountPath: "/data", ReadOnly: true}, {Name: "cache", MountPath: resticCacheDir}, }, // In buildRestoreJob, replace the VolumeMounts entry: VolumeMounts: []corev1.VolumeMount{ {Name: "restore", MountPath: "/restore"}, {Name: "cache", MountPath: resticCacheDir}, }, // In resticEnv, replace the RESTIC_CACHE_DIR entry: {Name: "RESTIC_CACHE_DIR", Value: resticCacheDir}, ``` ## Links - SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=soteria&open=AZ9pTqVcN0JrBQvDGDs3 - Full evidence bundle and audit trail live in Ariadne at `/api/admin/audit/events`, event types `hermes_autotriage_incident` and `hermes_autotriage_diagnosis`. Filed automatically by Ariadne from a Hermes Agent diagnosis (run [run_73eda560dd3f4b90a31118cec4a4f664](https://triage.bstein.dev/chat?resume=run_73eda560dd3f4b90a31118cec4a4f664)). Hermes has no write access to this repository; no files or infrastructure were changed.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: titan/soteria#69