Unit tests pass hardcoded '/tmp/...' strings as fake module arguments (for
example chart_ref) into fully mocked helm commands, so no file is ever
created and there is no real exposure. SonarCloud's python:S5443 still
raises a security hotspot on each literal and, because it only scores new
code, drops a PR's security rating even though the same pattern already
pervades the existing test suite.
Scope the suppression to tests/** only. Production code creates temporary
files via tempfile.mkstemp / NamedTemporaryFile and remains covered by the
rule, where it carries real value.
AI-assisted commit with Claude Opus
Ansible module argument_spec is conventionally defined with the dict(...)
constructor rather than {...} literals, for readability and consistency
across the collection. SonarCloud's python:S7498 ("Literal syntax should
be preferred...") flags this as a false positive and re-fires on every
new module argument. Ignore the rule project-wide via sonar-project.properties.
Fixes#1151
