🩹(all) clear the SonarCloud reliability finding and the lint debt

The SonarCloud gate fails on main, so every commit lands red, and
gh run list hides it: it lists only Actions workflows, and the
failure is an app check run.

Reliability rests on one bug, in test_file_service.py, which wrapped
an assertion in an except Exception re-raised through pytest.fail.
Removing it takes the rating from D to A.

Two pieces of debt ride along. The SDK callback id now comes from
crypto.getRandomValues, since it guards an endpoint with no auth. And
core/tasks gets the __init__.py that lets pylint see it, with the
debt that exposes, which is why #1533 fails lint-back.

CHANGELOG.md

@@ -29,7 +29,7 @@ and this project adheres to
 - 💄(frontend) improve participant name rendering in the list
 - 🚚(backend) rename TelephonyService to SIPManagement
 
-## Fixed
+### Fixed
 
 - 🐛(transcription) fix silent bug in speaker assignment
 - 🐛(summary) extend tasks auto retry logic
@@ -38,6 +38,7 @@ and this project adheres to
 - 🐛(backend) allow any string as sub in the API serializer
 - 🐛(frontend) fall back to user.full_name on request-entry
 - 🚸(frontend) show two initials in the Avatar when possible
+- 🩹(all) clear the SonarCloud reliability finding and the lint debt
 
 ## [1.24.0] - 2026-07-21
 

src/backend/core/tasks/_task.py

@@ -1,4 +1,11 @@
+"""
+Celery task decorator that degrades to a synchronous call when Celery is off.
+"""
+
+# The Celery app is imported lazily so that importing this module does not pull
+# in Celery when CELERY_ENABLED is false.
 # ruff: noqa: PLC0415
+# pylint: disable=import-outside-toplevel
 
 from django.conf import settings
 

src/frontend/src/features/sdk/utils/CallbackIdHandler.ts

@@ -2,9 +2,12 @@ export class CallbackIdHandler {
   private readonly storageKey = 'popup_callback_id'
 
   private generateId(): string {
-    return (
-      Math.random().toString(36).substring(2, 15) +
-      Math.random().toString(36).substring(2, 15)
+    // The id is the only thing guarding /rooms/creation-callback/, which is
+    // unauthenticated, so it comes from the CSPRNG rather than Math.random.
+    const bytes = new Uint8Array(16)
+    crypto.getRandomValues(bytes)
+    return Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0')).join(
+      ''
     )
   }
 

src/summary/tests/unit/test_file_service.py

@@ -143,13 +143,9 @@ def test_media_info_ignores_empty_stream_entry(monkeypatch: pytest.MonkeyPatch)
 
 def test_extract_audio_from_video():
     """Test that extract_audio_from_video can extract audio from a video file."""
-    path = None
+    path = extract_audio_from_media(MEDIA_INFO_SAMPLE_VISIO)
     # A bit of cleanup logic since this is not a generator
     try:
-        path = extract_audio_from_media(MEDIA_INFO_SAMPLE_VISIO)
         assert path.name.endswith(".m4a")
-    except Exception as e:
-        pytest.fail(f"Failed to extract audio from video: {e}")
     finally:
-        if path and path.exists():
-            path.unlink()
+        path.unlink(missing_ok=True)