From 40e5bfef6edb4c9797d39193c98387514c217e3d Mon Sep 17 00:00:00 2001
From: davd-gzl <60177543+davd-gzl@users.noreply.github.com>
Date: Sun, 2 Aug 2026 22:01:33 +0200
Subject: [PATCH] =?UTF-8?q?=F0=9F=A9=B9(all)=20clear=20the=20SonarCloud=20?=
 =?UTF-8?q?reliability=20finding=20and=20the=20lint=20debt?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The SonarCloud gate fails on main, so every commit lands red, and
gh run list hides it: it lists only Actions workflows, and the
failure is an app check run.

Reliability rests on one bug, in test_file_service.py, which wrapped
an assertion in an except Exception re-raised through pytest.fail.
Removing it takes the rating from D to A.

Two pieces of debt ride along. The SDK callback id now comes from
crypto.getRandomValues, since it guards an endpoint with no auth. And
core/tasks gets the __init__.py that lets pylint see it, with the
debt that exposes, which is why #1533 fails lint-back.
---
 CHANGELOG.md                                             | 3 ++-
 src/backend/core/tasks/__init__.py                       | 0
 src/backend/core/tasks/_task.py                          | 7 +++++++
 src/frontend/src/features/sdk/utils/CallbackIdHandler.ts | 9 ++++++---
 src/summary/tests/unit/test_file_service.py              | 8 ++------
 5 files changed, 17 insertions(+), 10 deletions(-)
 create mode 100644 src/backend/core/tasks/__init__.py

diff --git a/CHANGELOG.md b/CHANGELOG.md
index bfb7203d..987b7959 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -29,7 +29,7 @@ and this project adheres to
 - 💄(frontend) improve participant name rendering in the list
 - 🚚(backend) rename TelephonyService to SIPManagement
 
-## Fixed
+### Fixed
 
 - 🐛(transcription) fix silent bug in speaker assignment
 - 🐛(summary) extend tasks auto retry logic
@@ -38,6 +38,7 @@ and this project adheres to
 - 🐛(backend) allow any string as sub in the API serializer
 - 🐛(frontend) fall back to user.full_name on request-entry
 - 🚸(frontend) show two initials in the Avatar when possible
+- 🩹(all) clear the SonarCloud reliability finding and the lint debt
 
 ## [1.24.0] - 2026-07-21
 
diff --git a/src/backend/core/tasks/__init__.py b/src/backend/core/tasks/__init__.py
new file mode 100644
index 00000000..e69de29b
diff --git a/src/backend/core/tasks/_task.py b/src/backend/core/tasks/_task.py
index 01c362a0..ede151be 100644
--- a/src/backend/core/tasks/_task.py
+++ b/src/backend/core/tasks/_task.py
@@ -1,4 +1,11 @@
+"""
+Celery task decorator that degrades to a synchronous call when Celery is off.
+"""
+
+# The Celery app is imported lazily so that importing this module does not pull
+# in Celery when CELERY_ENABLED is false.
 # ruff: noqa: PLC0415
+# pylint: disable=import-outside-toplevel
 
 from django.conf import settings
 
diff --git a/src/frontend/src/features/sdk/utils/CallbackIdHandler.ts b/src/frontend/src/features/sdk/utils/CallbackIdHandler.ts
index aeee0736..80cf0fe2 100644
--- a/src/frontend/src/features/sdk/utils/CallbackIdHandler.ts
+++ b/src/frontend/src/features/sdk/utils/CallbackIdHandler.ts
@@ -2,9 +2,12 @@ export class CallbackIdHandler {
   private readonly storageKey = 'popup_callback_id'
 
   private generateId(): string {
-    return (
-      Math.random().toString(36).substring(2, 15) +
-      Math.random().toString(36).substring(2, 15)
+    // The id is the only thing guarding /rooms/creation-callback/, which is
+    // unauthenticated, so it comes from the CSPRNG rather than Math.random.
+    const bytes = new Uint8Array(16)
+    crypto.getRandomValues(bytes)
+    return Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0')).join(
+      ''
     )
   }
 
diff --git a/src/summary/tests/unit/test_file_service.py b/src/summary/tests/unit/test_file_service.py
index f7e6fc6d..33f89b37 100644
--- a/src/summary/tests/unit/test_file_service.py
+++ b/src/summary/tests/unit/test_file_service.py
@@ -143,13 +143,9 @@ def test_media_info_ignores_empty_stream_entry(monkeypatch: pytest.MonkeyPatch)
 
 def test_extract_audio_from_video():
     """Test that extract_audio_from_video can extract audio from a video file."""
-    path = None
+    path = extract_audio_from_media(MEDIA_INFO_SAMPLE_VISIO)
     # A bit of cleanup logic since this is not a generator
     try:
-        path = extract_audio_from_media(MEDIA_INFO_SAMPLE_VISIO)
         assert path.name.endswith(".m4a")
-    except Exception as e:
-        pytest.fail(f"Failed to extract audio from video: {e}")
     finally:
-        if path and path.exists():
-            path.unlink()
+        path.unlink(missing_ok=True)