packages/vscode-extension/SUMMARY.md claims a CodeQL scan passed; no CodeQL scan exists

Found while fixing #5408 (stale CodeQL badge in README.md). Out of that
card's file surface (README.md only), so filed separately rather than
fixed there.

Measured

packages/vscode-extension/SUMMARY.md line ~164:

✅ **安全扫描**
- CodeQL扫描通过
- 无安全漏洞
- 无已知问题

("Security scan — CodeQL scan passed — no security vulnerabilities — no
known issues.")

Same underlying fact #5408 established: this repository has no
dynamic/github-code-scanning/codeql workflow entry and no codeql.yml —
CodeQL was never set up here, default-setup or otherwise. A claim that a
CodeQL scan "passed" is stronger than #5408's badge (which merely implied a
scan runs) — this asserts a specific run outcome for a scan that does not
exist.

Note on this file's nature

This reads like a one-off, hand-written status summary (possibly from an AI
coding session) rather than living/maintained documentation — worth checking
whether the file should be corrected, or removed as a stale artifact, when
triaged. Flagging as finding rather than a concrete fix instruction for
that reason.

Scope

packages/vscode-extension/SUMMARY.md only.

vscode不是开发方向，此软件包应该作废

Concentrated triage batch: finding → pm:queue + domain:devx, Task, S — premise re-verified on origin/main (SUMMARY.md:164 still claims a CodeQL scan passed; the repo has no CodeQL setup, per #5408's established fact). Recommended disposition inherits #5408's direction: this file reads as a one-off session artifact, and a false security-scan claim must not survive — REMOVE the file (or, if the ui seat finds it referenced anywhere, correct the security section to the truth). Read the one comment on the thread at claim.

Generated by Claude Code

@os-zhuang

Claiming this issue.

Session: session_019b5UBNMtTzKbVtZZGvFuxe
Branch: claude/issue-5965-summary-codeql-claim

Premise re-verified on origin/main (ef2a3bd8d): grep -rni codeql .github/ exits 1 (no matches), and there is no codeql.yml among the 21 workflow files. The claim in packages/vscode-extension/SUMMARY.md still stands as filed.

Read both prior comments, including @os-zhuang's vscode不是开发方向，此软件包应该作废 — noted as input to the correct-vs-delete call. Scope stays SUMMARY.md only; deprecating the package is not this card.

Generated by Claude Code

{
  "issue": 5965,
  "status": "done",
  "branch": "claude/issue-5965-summary-codeql-claim",
  "pr": "https://github.com/objectstack-ai/objectui/pull/6276",
  "premise_still_valid": true,
  "summary": "Premise re-verified on origin/main ef2a3bd8d before editing: `grep -rni codeql .github/` exits 1 and there is no codeql.yml among 21 workflows, so SUMMARY.md asserted a run outcome for a scan that never existed. Chose DELETE over correct, against the dispatch's lean, on evidence I was asked to gather rather than assume: nothing references the file (`git grep 'SUMMARY\\.md'` returns one hit, and it is the unrelated SECURITY_FIX_SUMMARY.md), and it never shipped (package is `private: true`; `.vscodeignore` is `*.md` + `!README.md`, so it was excluded from the VSIX). Correcting was the weaker option because the false security claim was not one line — it recurred at lines 235, 304 and 309 — and sat beside `- [x] 单元测试通过` in a package with zero test files, plus `代码完成度: 100%`; the document is a frozen session status report with no correct state short of a maintainer re-measuring every tick, and its durable content (commands, snippets, config, structure) is already in README.md/DESIGN.md/PUBLISHING.md. CONTRIBUTING.md:393 already carries the truth: the repo 'does **not** run static-analysis security scanning of its own source code (CodeQL or equivalent)'. No softer replacement claim was introduced — the section is gone, not reworded. Scope stayed SUMMARY.md; README.md (#5408) untouched. Note @os-zhuang's `vscode不是开发方向，此软件包应该作废` supports the direction but retiring the package is a separate call for PM.",
  "tests": "All on final commit ff19626b7, clean tree; exit codes captured by redirect before any pipe, each quoting the gate's own verdict line. check-doc-links.mjs exit 0 -> 'Links are valid across 15 scan roots.' | check:doc-fences exit 0 -> 'check:doc-fences — every TypeScript block in 223 document(s) is fenced ts/tsx/typescript...' | check:control-bytes exit 0 -> 'check-control-bytes: OK (scanned 5171 tracked text file(s); skipped 85 binary).' | check-changeset-presence exit 0 -> '3 file(s) changed, 0 of them published source of a package the release covers, 1 changeset(s) added. No source of a released package changed in this range, so no changeset is owed.' | check-changeset-no-major exit 0 -> 'No changeset declares a major bump.' | lint:root UNNARROWED exit 0 -> '28 problems (0 errors, 28 warnings)', all pre-existing no-explicit-any in untouched files. TEST FIX IN SAME COMMIT: the deletion broke two objectui#4938 population floors in scripts/__tests__/check-doc-links.test.ts — 'expected 11 to be greater than or equal to 12' (line 446) and 'expected 14 to be greater than or equal to 15' (line 1606); lowered each by exactly the one deletion (12->11, 15->14) with the reason recorded inline, preserving their purpose of failing if the scanner stops walking. Edits confirmed on disk by grep (2 injected markers present, 0 old floors remaining) rather than by editor exit code. DECLARED NARROWING on vitest: the root suite was SIGTERM'd at the container's ~10-min foreground cap (exit 143) spraying ECONNREFUSED 127.0.0.1:3000 from unrelated live/e2e specs. Universe read from vitest's own config — `vitest list --filesOnly` = 1995 files; ran the affected set (all 6 files referencing vscode-extension plus doc-link/changeset/doc-type gate tests) = 9 files / 294 tests passing, and re-ran the ratchet family on final head = 5 files / 180 tests passing. Invariance: the diff removes one unreferenced .md, edits one test's own floor constants, and adds a changeset; no test references SUMMARY.md (grep hits 0) and no source module is touched, so no test outside the ran set can change verdict through it. CI runs the full farm regardless.",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #6275: packages/core/src/validation/validators/object-validation-engine.ts:221 has `@see .../blob/main/SECURITY_FIX_SUMMARY.md`, deleted in ea72f1886 — link 404s and ships in the published @object-ui/core; no link gate covers @see URLs in .ts source",
    "not filed, PM heads-up: agent on #6026 (claude/issue-6026-nested-readme-doc-links) is editing the same check-doc-links surface. Semantically safe — nested READMEs would raise the population and these are floors — but expect a textual merge conflict in check-doc-links.test.ts",
    "not filed, maintainer call not mine: @os-zhuang says the whole vscode-extension package should be retired (`此软件包应该作废`). It is private:true, has zero test files, and is otherwise unreferenced — worth a triage decision, but out of this card's scope"
  ]
}

Generated by Claude Code

os-dev-report

(Re-posting: the  HTML-comment marker on the previous comment was stripped by GitHub's sanitizer after it landed, making that copy invisible to the PM scan. Same report, marker as literal text. Supersedes comment 5406711760.)

{
  "issue": 5965,
  "status": "done",
  "branch": "claude/issue-5965-summary-codeql-claim",
  "pr": "https://github.com/objectstack-ai/objectui/pull/6276",
  "premise_still_valid": true,
  "summary": "Premise re-verified on origin/main ef2a3bd8d before editing: `grep -rni codeql .github/` exits 1 and there is no codeql.yml among 21 workflows, so SUMMARY.md asserted a run outcome for a scan that never existed. Chose DELETE over correct, against the dispatch's lean, on evidence I was asked to gather rather than assume: nothing references the file (`git grep 'SUMMARY\\.md'` returns one hit, and it is the unrelated SECURITY_FIX_SUMMARY.md), and it never shipped (package is `private: true`; `.vscodeignore` is `*.md` + `!README.md`, so it was excluded from the VSIX). Correcting was the weaker option because the false security claim was not one line — it recurred at lines 235, 304 and 309 — and sat beside `- [x] 单元测试通过` in a package with zero test files, plus `代码完成度: 100%`; the document is a frozen session status report with no correct state short of a maintainer re-measuring every tick, and its durable content (commands, snippets, config, structure) is already in README.md/DESIGN.md/PUBLISHING.md. CONTRIBUTING.md:393 already carries the truth: the repo 'does **not** run static-analysis security scanning of its own source code (CodeQL or equivalent)'. No softer replacement claim was introduced — the section is gone, not reworded. Scope stayed SUMMARY.md; README.md (#5408) untouched. Note @os-zhuang's `vscode不是开发方向，此软件包应该作废` supports the direction but retiring the package is a separate call for PM.",
  "tests": "All on final commit ff19626b7, clean tree; exit codes captured by redirect before any pipe, each quoting the gate's own verdict line. check-doc-links.mjs exit 0 -> 'Links are valid across 15 scan roots.' | check:doc-fences exit 0 -> 'check:doc-fences — every TypeScript block in 223 document(s) is fenced ts/tsx/typescript...' | check:control-bytes exit 0 -> 'check-control-bytes: OK (scanned 5171 tracked text file(s); skipped 85 binary).' | check-changeset-presence exit 0 -> '3 file(s) changed, 0 of them published source of a package the release covers, 1 changeset(s) added. No source of a released package changed in this range, so no changeset is owed.' | check-changeset-no-major exit 0 -> 'No changeset declares a major bump.' | lint:root UNNARROWED exit 0 -> '28 problems (0 errors, 28 warnings)', all pre-existing no-explicit-any in untouched files. TEST FIX IN SAME COMMIT: the deletion broke two objectui#4938 population floors in scripts/__tests__/check-doc-links.test.ts — 'expected 11 to be greater than or equal to 12' (line 446) and 'expected 14 to be greater than or equal to 15' (line 1606); lowered each by exactly the one deletion (12->11, 15->14) with the reason recorded inline, preserving their purpose of failing if the scanner stops walking. Edits confirmed on disk by grep (2 injected markers present, 0 old floors remaining) rather than by editor exit code. DECLARED NARROWING on vitest: the root suite was SIGTERM'd at the container's ~10-min foreground cap (exit 143) spraying ECONNREFUSED 127.0.0.1:3000 from unrelated live/e2e specs. Universe read from vitest's own config — `vitest list --filesOnly` = 1995 files; ran the affected set (all 6 files referencing vscode-extension plus doc-link/changeset/doc-type gate tests) = 9 files / 294 tests passing, and re-ran the ratchet family on final head = 5 files / 180 tests passing. Invariance: the diff removes one unreferenced .md, edits one test's own floor constants, and adds a changeset; no test references SUMMARY.md (grep hits 0) and no source module is touched, so no test outside the ran set can change verdict through it. CI runs the full farm regardless.",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #6275: packages/core/src/validation/validators/object-validation-engine.ts:221 has `@see .../blob/main/SECURITY_FIX_SUMMARY.md`, deleted in ea72f1886 — link 404s and ships in the published @object-ui/core; no link gate covers @see URLs in .ts source",
    "not filed, PM heads-up: agent on #6026 (claude/issue-6026-nested-readme-doc-links) is editing the same check-doc-links surface. Semantically safe — nested READMEs would raise the population and these are floors — but expect a textual merge conflict in check-doc-links.test.ts",
    "not filed, maintainer call not mine: @os-zhuang says the whole vscode-extension package should be retired (`此软件包应该作废`). It is private:true, has zero test files, and is otherwise unreferenced — worth a triage decision, but out of this card's scope"
  ]
}

Generated by Claude Code

Navigation Menu

Repository navigation

packages/vscode-extension/SUMMARY.md claims a CodeQL scan passed; no CodeQL scan exists #5965

Measured

Note on this file's nature

Scope

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

packages/vscode-extension/SUMMARY.md claims a CodeQL scan passed; no CodeQL scan exists #5965

Description

Measured

Note on this file's nature

Scope

Activity

os-zhuang commented on Aug 24, 2026

claude commented on Aug 25, 2026

yinlianghui-tw commented on Aug 25, 2026

yinlianghui-tw commented on Aug 25, 2026

yinlianghui-tw commented on Aug 25, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions