fix: Fable5 scan report fixes Part 1 refs #953

[ilayfalach]

Summary

Implements 32 of 51 findings from the Fable5 automated code-scan report. All Critical (🔴) and Major (🟠) items that could be fixed without a full architectural redesign are addressed. Full status tracked in SCAN_STATUS.md.

Security (all 7 items fixed)

• Remove config.json from git tracking (live MongoDB credentials were committed) [1.1]
• Mask password field before debug logging [1.2]
• Parameterize bootstrap credentials via env vars (mongo-init.d, dockerfile, init_with_mongo.sh) [1.3]
• Replace all os.system(f-string) with subprocess.run([list]), os.symlink, shutil.* across 5 simulation files [1.4]
• Remove eval() on data-controlled strings (parsers.py dict counter; unitHandler.py deprecated) [1.5]
• Validate sys.path before inserting DB-supplied paths (existence + stdlib-shadow check); replace sys.path.insert in class handler with importlib.util; annotate unavoidable pickle usage with # nosec B301 [1.6]
• Convert remaining subprocess with shell=True to argument-list form [1.7]

Data Layer (7 of 13 fixed)

• Fix mutable default desc={} / getDataParams={} / actionList=[] across 6 files [2.2]
• Remove hardcoded absolute developer paths from shipped files (srtm_datasource.json, latex.py, ml.py) [2.3]
• Fix getAllDocuments silently returning empty results (desc=desc → **desc) [2.5]
• Fix getCacheDcouments typo → getCacheDocuments [2.7]
• Replace inline angle-math lambdas with hera.utils.toMeteorologicalAngle/toMathematicalAngle [2.9]
• Replace raw EPSG integers with WSG84/ITM named constants across 4 files [2.10]

Architecture (6 of 11 fixed)

• Correct broken OF_LSM registry cls path [3.1]
• Remove hidden DB setConfig() write from getDataSourceDocument getter [3.4]
• Add **kwargs to abstractToolkit.__init__ [3.6]
• Remove circular import datalayer → toolkit [3.7]

Code Quality (3 of 6 fixed)

• Replace bare except: with except Exception: in windProfile/toolkit.py and utils/data/CLI.py [4.2]

Testing & CI (3 of 6 fixed / 1 confirmed not an issue)

• Item 5.1 confirmed not an issue (already fixed in Full test suite pass CICD on pull requests #884)
• Replace slow Project-based MongoDB probe with pymongo.MongoClient(serverSelectionTimeoutMS=1000) [5.3]
• Remove outer try/except from compare_outputs that was swallowing test failures [5.4]

Packaging & Hygiene (6 of 8 fixed)

• Rewrite README to accurately describe Hera (was Django/GIS boilerplate) [6.1]
• Read version= dynamically from hera/__init__.__version__ in setup.py [6.2]
• Add 11 core runtime dependencies to setup.py install_requires [6.3]
• Fix hardcoded /home/eran paths in ui/client/TEST_UI.md [6.4]
• Untrack 31 MB of conda tarballs with git rm --cached; add pattern to .gitignore [6.5]
• Update meta.yaml version, git URL, and dependencies [6.6]

Postponed items

Two Critical items are not in this PR due to architectural scope:

• 2.1 — import hera performs network I/O, filesystem writes, and DB writes at import time. Requires a full lazy-connection redesign. Tracked in a follow-up issue.
• 5.2 — Zero test coverage for simulations/ (~70 modules) and riskassessment/ (~17 modules). Substantial test-writing effort, tracked under Fix Matplotlib 3.10 compatibility in toGeopandas and expand toolkit unit test coverage #943 and a follow-up issue.

Full item-by-item status in SCAN_STATUS.md.

Test plan

• pytest hera/tests/ passes (or skips cleanly when MongoDB is unavailable)
• git ls-files config.json returns nothing
• grep -rn "os\.system(" hera/simulations/ returns no live hits
• grep -rn "getCacheDcouments" hera/ returns no hits
• python -c "import hera; from hera import Project" succeeds without circular import error

🤖 Generated with Claude Code