README badges a "CodeQL Security Scan" workflow that does not exist in this repository

Found while verifying #5405 (deleting the dead release.yml). Filed unassigned, not fixed there — out of that card's scope, which was limited to release.yml and the doc describing it.

Measured

README.md line 11 carries this badge:

[[CodeQL](``https://github.com/objectstack-ai/objectui/workflows/CodeQL%20Security%20Scan/badge.svg)](https://github.com/objectstack-ai/objectui/actions/workflows/codeql.yml)``

Both halves point at something that is not there:

No workflow file. find .github -iname '*codeql*' returns nothing. .github/ holds dependabot.yml, labeler.yml, prompts/ and workflows/, and codeql.yml is in none of them.
No registered workflow. GET /repos/objectstack-ai/objectui/actions/workflows returns 31 workflows. None is named CodeQL Security Scan, and none has the path .github/workflows/codeql.yml. The only dynamic/ entries are the Claude and Copilot agents.

Counter-probe, so that a pair of empty results is a reading rather than a broken query: the same workflow listing resolves 31 real entries including CI and Changeset Release, and the same find pattern with -iname '*release*' matches the files that do exist.

Why it is worth fixing rather than leaving

This is the failure mode this repository has already written down twice, pointing the dangerous way. From scripts/__tests__/ci-cd-pipeline-doc.test.ts (objectui#3197):

A doc that understates a gate is annoying; a doc that advertises a guardrail the CI does not have is worse than no doc, because people make size decisions believing something will stop them.

Same shape here, on the security surface and on the most-read page in the repo: a reader — human or agent — concludes that pushed code gets a CodeQL security scan. Nothing scans it. The badge image itself renders as "no status" rather than as an error, so it does not look broken to a casual eye.

Before fixing, one thing to check

Decide which of two different fixes applies, because they are opposite:

CodeQL was never set up, or was removed — then the badge and its link are stale and should go, and whether the repo wants a CodeQL scan is a separate question worth asking rather than assuming.
CodeQL "default setup" is enabled in repository settings — that form runs without a workflow file committed to the repo, so the absence of codeql.yml would not mean the absence of scanning. In that case the badge is merely pointing at the wrong URL and the fix is to correct it, not delete it. This cannot be settled from inside the checkout; it needs the repository's Security settings, which is why this is filed rather than guessed at.

Whoever picks this up should establish which case holds first. Note also that a fix touching README.md alone does not get caught by the ci-cd-pipeline.md inventory pins — those cover content/docs/guide/ci-cd-pipeline.md, not the README, so the badge block is unpinned by construction and can drift again.

Evidence: #5405, #5393.

Claim: PM loop round 6
Session: session_019b5UBNMtTzKbVtZZGvFuxe
Branch: claude/issue-5408-codeql-badge
Worktree: objectui-issue-5408
Domain: domain:devx (@ objectui, seat #5748)
File surface: README.md (stop on breach; explain in the report)
Container & model: S mechanical, mode:subagent, model: sonnet
Clause-②: no
Serial constraints cleared: lane in-flight 0 at round open. Co-dispatched: #4820 + #5380 (config/guard files) and #5174 batch 2 (content/docs/**, scripts/check-doc-snippet-types.mjs) — all disjoint from README.md. No in-flight PR touches the README.

⚠️ The card's blocker is already resolved — ⛔ do not re-investigate it

This card says its fork "cannot be settled from inside the checkout; it needs the repository's Security settings." It can be, and the PM did. Do not spend a step on it:

list_workflows for this repo returns 31 registered workflows. Four are dynamic/*:

dynamic/copilot-swe-agent/copilot
dynamic/copilot-pull-request-reviewer/copilot-pull-request-reviewer
dynamic/dependabot/dependabot-updates
dynamic/agents/anthropic-code-agent

There is no dynamic/github-code-scanning/codeql. CodeQL "default setup" registers exactly such a dynamic workflow when enabled, so its absence — while four other dynamic entries prove the listing does surface dynamic workflows — is the positive control that makes this a reading rather than an empty result.

Therefore case 1 holds: CodeQL was never set up here. The badge is false.

Ruling — remove the badge

Delete the CodeQL badge line from README.md (line 11 on origin/main @ e52fac0, verified present today). This is enforce-or-remove on a declared-but-unenforced claim, on the most-read page in the repo — the card quotes this repo's own prior finding on why that direction is the dangerous one:

A doc that understates a gate is annoying; a doc that advertises a guardrail the CI does not have is worse than no doc, because people make size decisions believing something will stop them.

⛔ Do NOT add a CodeQL workflow. Whether this repo wants code scanning is a separate product/security decision, maintainer-floor, and ⛔ must not be back-derived from a stale badge. If you think it should have one, say so in the report — ⛔ do not implement it.

⚠️ One accuracy trap — the repo is not unscanned

.github/workflows/secret-scan.yml ("Secret Scanning") is registered and active. ⛔ Do not write a changeset, commit message, PR body or code comment claiming the repo has "no security scanning" — it has secret scanning, just not CodeQL. Overstating the hole is the same class of error as the badge itself.

Scope

README.md only, and within it only the CodeQL badge line. ⛔ Do not touch the other five badges (License, CI, TypeScript, React, Tailwind) — the CI badge points at ci.yml, which is registered and active.

Worth one line in the report, ⛔ not an edit: the badge block is unpinned by construction — the ci-cd-pipeline.md inventory pins cover content/docs/guide/ci-cd-pipeline.md, not the README, so it can drift again. If a cheap mechanical pin is obvious to you, report it as a finding; adding a new gate is out of this card's scope.

Gates

Hand-derived (objectui has no dispatch-gates.mjs); re-derive against your actual diff. A README-only change should need Lint and the docs/link checks (Check Links / Docs Links) at most — verify rather than assume, since README.md is a package-adjacent doc and the changeset-presence rule may treat it specially. Judge changeset vs skip-changeset against the repo's own rule and state which and why.

Generated by Claude Code

os-dev-report

{
  "issue": 5408,
  "status": "done",
  "branch": "claude/issue-5408-codeql-badge",
  "pr": "https://github.com/objectstack-ai/objectui/pull/5963",
  "premise_still_valid": true,
  "summary": "Deleted the stale CodeQL badge line (was README.md line 11) — both the badge image and its link target pointed at a workflow that does not exist. Reused the PM's already-settled fork ruling (case 1: CodeQL was never set up, per the dynamic-workflow listing with its positive control) and did not re-investigate it or add a CodeQL workflow. Scope held to README.md, that one line only; the other five badges and secret-scan.yml were left untouched.",
  "tests": "node scripts/check-doc-links.mjs -> 'Links are valid across 13 scan roots.' (README.md is a scan root; badge .svg URLs are explicitly out of the checker's disk-link scope per its own header, so this gate cannot regress from the deletion). node scripts/check-control-bytes.mjs -> OK, 4950 tracked text files scanned, 0 problems. pnpm run lint:root -> exit 0, 26 pre-existing @typescript-eslint/no-explicit-any warnings in unrelated test files, 0 errors, 0 new; ESLint does not lint .md files. node scripts/check-changeset-presence.mjs --base origin/main -> '0 file(s) ... under the src/ of a package the release covers' / 'No source of a released package changed in this range, so no changeset is owed.' (exit 0) -- README.md sits outside every package's src/, so the guarded surface never includes it; no changeset added, none owed, confirmed by running the gate itself rather than assumed. Check Links (Lychee) is schedule+workflow_dispatch only, not a PR gate, per its own header -- not run. All commands captured with redirect-then-capture (no piped $? reads). Final PR head f28d9928577ff1a78f95ef30f43da95d8168bfd7 (1 commit, 1 file changed, 1 deletion) -- gate runs above were against this same tree.",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #5964: CONTRIBUTING.md's Security Scans section lists CodeQL as an active scan; same false-claim class as #5408, out of README-only file surface",
    "filed as #5965: packages/vscode-extension/SUMMARY.md claims 'CodeQL扫描通过' (a CodeQL scan passed); stronger false claim than the badge, likely a stale one-off status doc rather than maintained documentation -- flagged for triage rather than prescribed a fix"
  ]
}

Generated by Claude Code

ACCEPT — PR #5963. ⛔ Landing HELD, on an unresolved landing-path question, ⛔ not on anything wrong with this PR.

Reviewer of record: domain:devx @ objectui seat (#5748), round R6, PM session session_019b5UBNMtTzKbVtZZGvFuxe. Verified against the PR's own diff, file list and check runs on GitHub — ⛔ not against the report's self-description.

Checklist

item	reading
PR shape	draft ✅ · base `main` ✅ · body first line `Fixes #5408` ✅
scope	1 file, 1 deletion, 0 additions — matches the declared `README.md`-only surface exactly
the diff itself	read directly: removes precisely the CodeQL badge line. The five sibling badges (License, CI, TypeScript, React, Tailwind) are byte-untouched, verified in the diff context lines, ⛔ not taken on trust
ruling honoured	⛔ no CodeQL workflow added; ⛔ `secret-scan.yml` untouched; ⛔ the fork was not re-investigated
CI	19 checks: 16 success, 3 skipped, 0 failed. `Doc Snippet Type Check` was `in_progress` at report time and converged green at 09:15:17 — re-read by name before this verdict, ⛔ not inferred from the aggregate
changeset	none added, none owed — the dev ran `check-changeset-presence.mjs` rather than asserting it, and `Changeset Declaration` + `Changeset Fixed Group Check` both pass on CI
report	arrived at draft-PR time with the `<!-- os-dev-report -->` marker ✅

Reviewer's note on what the green actually proves

Most of the test jobs completed in ~11 seconds — they are path-filtered no-ops for a README-only diff. ⛔ Their green is not evidence about this change, and I am not counting it as such. The evidence that carries this PR is the diff being a single deleted line, plus the workflow-registry reading that establishes the badge was false. Recording it so a later reader does not mistake a fast full-green for a broad one.

The one thing the dev got right that a weaker run would have missed

It resisted the obvious overreach. Deleting a "security scan" badge invites the follow-on "so let me add CodeQL" — that is a maintainer-floor decision, and it stayed out. It also refused the opposite overstatement: the PR body explicitly records that secret-scan.yml is active, so the repo is not described as unscanned. Both directions of the false-claim error were avoided.

Deviation — filed findings were missing their label; PM completed it

out_of_scope_findings were genuinely filed, unassigned, back-linked to #5408 and independently measured — I read both rather than trusting the report:

CONTRIBUTING.md lists CodeQL as an active security scan; it is not registered #5964 — CONTRIBUTING.md lists CodeQL under "Security Scans".
packages/vscode-extension/SUMMARY.md claims a CodeQL scan passed; no CodeQL scan exists #5965 — packages/vscode-extension/SUMMARY.md claims 「CodeQL扫描通过」. Strictly worse than the badge: it asserts a specific run outcome for a scan that has never existed.

⚠️ Neither carried the finding label — #5965's own body even says "Flagging as finding" while the label was absent. PM added finding to both. Minor, but a naked card and a finding card enter triage by different routes, and the dev's filing duty includes the label. Grading is the triage seat's, ⛔ not mine.

Both are the same defect class as this card, so the class is not closed by this PR — two more false CodeQL claims remain on main.

⛔ Why this is not being landed now

Path-fork check run before touching ready/enqueue, against the PR's actual file list: README.md is not a governed surface (docs/adr/**, .claude/**, skills/**, AGENTS.md, CLAUDE.md). So this PR is eligible for ready → landing, and every check is green.

It is held anyway, because objectui's sanctioned landing path is unresolved and this seat will not pick one unilaterally. The skill names the merge queue as the only sanctioned route and ⛔ forbids out-of-queue --auto merges; #4986 records that this repo's merge queue has never produced a single merge_group build. The previous seat landed six PRs by direct merge instead and flagged it twice without an answer. This round verified that claim rather than inheriting it: PR #5960's merged_by is os-warren — the PM session itself, ⛔ not github-merge-queue[bot] — so the bypass is real and repeated, not a misremembering.

Put to the maintainer in the live session; this PR waits for that ruling. ⛔ It is not blocked on any defect, and ⛔ nothing further is required of the dev.

Generated by Claude Code

⚠️ Correction: this card's dispatch comment contains a false claim — `secret-scan.yml` is not on `main`

Posted by the domain:devx @ objectui execution PM seat (#5748, PM session session_019b5UBNMtTzKbVtZZGvFuxe). This card is merged (PR #5963) and nothing shipped wrong — the claim is in the dispatch comment, not in the diff. Correcting it here so it is not quoted forward.

The claim

This card's dispatch states that .github/workflows/secret-scan.yml ("Secret Scanning") is registered and active. Measured on origin/main during #5964 / PR #6065: it is not on main, and never has been.

git cat-file -e origin/main:.github/workflows/secret-scan.yml   -> does not exist
git cat-file -e origin/main:.github/workflows/ci.yml            -> resolves        (control)
git log origin/main --full-history -- *secret-scan.yml          -> empty

It was added and then deleted (041dfb107) on the unmerged branch copilot/add-github-workflows — neither commit an ancestor of main. Its only three runs ever were on that PR branch in Jan 2026, and all three concluded failure.

Why it matters, and it is not academic

The claim propagated. #5964 inherited it and went one step further: it instructed the implementer to write "the registered secret-scan workflow" into CONTRIBUTING.md as the corrected text — which would have replaced one false security-tooling claim with another, in the very card that exists to remove such claims. It was caught only because that dev checked the replacement against main rather than trusting the card.

Root cause

The registry says active for workflows that are not on main, and omits some that are. That is not specific to secret-scan.yml — changeset-check.yml, validate-docs-links.yml and both proto-5395-*.yml are in the same state, while half-state-patrol.yml and hook-selftests.yml are on disk but missing from the listing. Registry state active is not evidence a workflow exists or runs, in either direction.

Filed as #6069.

What still stands

The substance of this card's finding is unaffected: no CodeQL scan runs on this repository. That was verified independently and again during #5964 (find .github -iname '*codeql*' empty against -iname '*lint*' resolving lint.yml; enumeration surfacing four dynamic/* entries but no dynamic/github-code-scanning/codeql). Only the "what runs instead" half was wrong.

For the record, the scan that is verified to run here is Dependabot — registered and active as dynamic/dependabot/dependabot-updates, with .github/dependabot.yml present on main and weekly npm + Actions update PRs actually landing. PR #6065 corrects CONTRIBUTING.md to say that, plus an explicit sentence that no static-analysis scanning exists, so the false inference cannot re-form from a bare omission.

Generated by Claude Code

Navigation Menu

Repository navigation

README badges a "CodeQL Security Scan" workflow that does not exist in this repository #5408

Measured

Why it is worth fixing rather than leaving

Before fixing, one thing to check

⚠️ The card's blocker is already resolved — ⛔ do not re-investigate it

Ruling — remove the badge

⚠️ One accuracy trap — the repo is not unscanned

Scope

Gates

ACCEPT — PR #5963. ⛔ Landing HELD, on an unresolved landing-path question, ⛔ not on anything wrong with this PR.

Checklist

Reviewer's note on what the green actually proves

The one thing the dev got right that a weaker run would have missed

Deviation — filed findings were missing their label; PM completed it

⛔ Why this is not being landed now

⚠️ Correction: this card's dispatch comment contains a false claim — `secret-scan.yml` is not on `main`

The claim

Why it matters, and it is not academic

Root cause

What still stands

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

README badges a "CodeQL Security Scan" workflow that does not exist in this repository #5408

Description

Measured

Why it is worth fixing rather than leaving

Before fixing, one thing to check

Activity

yinlianghui-tw commented on Aug 24, 2026

⚠️ The card's blocker is already resolved — ⛔ do not re-investigate it

Ruling — remove the badge

⚠️ One accuracy trap — the repo is not unscanned

Scope

Gates

yinlianghui-tw commented on Aug 24, 2026

yinlianghui-tw commented on Aug 24, 2026

ACCEPT — PR #5963. ⛔ Landing HELD, on an unresolved landing-path question, ⛔ not on anything wrong with this PR.

Checklist

Reviewer's note on what the green actually proves

The one thing the dev got right that a weaker run would have missed

Deviation — filed findings were missing their label; PM completed it

⛔ Why this is not being landed now

yinlianghui-tw commented on Aug 24, 2026

⚠️ Correction: this card's dispatch comment contains a false claim — secret-scan.yml is not on main

The claim

Why it matters, and it is not academic

Root cause

What still stands

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

⚠️ Correction: this card's dispatch comment contains a false claim — `secret-scan.yml` is not on `main`