README badges a "CodeQL Security Scan" workflow that does not exist in this repository

[os-support-ai]

Found while verifying #5405 (deleting the dead release.yml). Filed unassigned, not fixed there — out of that card's scope, which was limited to release.yml and the doc describing it.

Measured

README.md line 11 carries this badge:

[[CodeQL](``https://github.com/objectstack-ai/objectui/workflows/CodeQL%20Security%20Scan/badge.svg)](https://github.com/objectstack-ai/objectui/actions/workflows/codeql.yml)``

Both halves point at something that is not there:

• No workflow file. find .github -iname '*codeql*' returns nothing. .github/ holds dependabot.yml, labeler.yml, prompts/ and workflows/, and codeql.yml is in none of them.
• No registered workflow. GET /repos/objectstack-ai/objectui/actions/workflows returns 31 workflows. None is named CodeQL Security Scan, and none has the path .github/workflows/codeql.yml. The only dynamic/ entries are the Claude and Copilot agents.

Counter-probe, so that a pair of empty results is a reading rather than a broken query: the same workflow listing resolves 31 real entries including CI and Changeset Release, and the same find pattern with -iname '*release*' matches the files that do exist.

Why it is worth fixing rather than leaving

This is the failure mode this repository has already written down twice, pointing the dangerous way. From scripts/__tests__/ci-cd-pipeline-doc.test.ts (objectui#3197):

A doc that understates a gate is annoying; a doc that advertises a guardrail the CI does not have is worse than no doc, because people make size decisions believing something will stop them.

Same shape here, on the security surface and on the most-read page in the repo: a reader — human or agent — concludes that pushed code gets a CodeQL security scan. Nothing scans it. The badge image itself renders as "no status" rather than as an error, so it does not look broken to a casual eye.

Before fixing, one thing to check

Decide which of two different fixes applies, because they are opposite:

1. CodeQL was never set up, or was removed — then the badge and its link are stale and should go, and whether the repo wants a CodeQL scan is a separate question worth asking rather than assuming.
2. CodeQL "default setup" is enabled in repository settings — that form runs without a workflow file committed to the repo, so the absence of codeql.yml would not mean the absence of scanning. In that case the badge is merely pointing at the wrong URL and the fix is to correct it, not delete it. This cannot be settled from inside the checkout; it needs the repository's Security settings, which is why this is filed rather than guessed at.

Whoever picks this up should establish which case holds first. Note also that a fix touching README.md alone does not get caught by the ci-cd-pipeline.md inventory pins — those cover content/docs/guide/ci-cd-pipeline.md, not the README, so the badge block is unpinned by construction and can drift again.

Evidence: #5405, #5393.

[yinlianghui-tw]

Claim: PM loop round 6
Session: session_019b5UBNMtTzKbVtZZGvFuxe
Branch: claude/issue-5408-codeql-badge
Worktree: objectui-issue-5408
Domain: domain:devx (@ objectui, seat #5748)
File surface: README.md (stop on breach; explain in the report)
Container & model: S mechanical, mode:subagent, model: sonnet
Clause-②: no
Serial constraints cleared: lane in-flight 0 at round open. Co-dispatched: #4820 + #5380 (config/guard files) and #5174 batch 2 (content/docs/**, scripts/check-doc-snippet-types.mjs) — all disjoint from README.md. No in-flight PR touches the README.

⚠️ The card's blocker is already resolved — ⛔ do not re-investigate it

This card says its fork "cannot be settled from inside the checkout; it needs the repository's Security settings." It can be, and the PM did. Do not spend a step on it:

list_workflows for this repo returns 31 registered workflows. Four are dynamic/*:

• dynamic/copilot-swe-agent/copilot
• dynamic/copilot-pull-request-reviewer/copilot-pull-request-reviewer
• dynamic/dependabot/dependabot-updates
• dynamic/agents/anthropic-code-agent

There is no dynamic/github-code-scanning/codeql. CodeQL "default setup" registers exactly such a dynamic workflow when enabled, so its absence — while four other dynamic entries prove the listing does surface dynamic workflows — is the positive control that makes this a reading rather than an empty result.

Therefore case 1 holds: CodeQL was never set up here. The badge is false.

Ruling — remove the badge

Delete the CodeQL badge line from README.md (line 11 on origin/main @ e52fac0, verified present today). This is enforce-or-remove on a declared-but-unenforced claim, on the most-read page in the repo — the card quotes this repo's own prior finding on why that direction is the dangerous one:

A doc that understates a gate is annoying; a doc that advertises a guardrail the CI does not have is worse than no doc, because people make size decisions believing something will stop them.

⛔ Do NOT add a CodeQL workflow. Whether this repo wants code scanning is a separate product/security decision, maintainer-floor, and ⛔ must not be back-derived from a stale badge. If you think it should have one, say so in the report — ⛔ do not implement it.

⚠️ One accuracy trap — the repo is not unscanned

.github/workflows/secret-scan.yml ("Secret Scanning") is registered and active. ⛔ Do not write a changeset, commit message, PR body or code comment claiming the repo has "no security scanning" — it has secret scanning, just not CodeQL. Overstating the hole is the same class of error as the badge itself.

Scope

README.md only, and within it only the CodeQL badge line. ⛔ Do not touch the other five badges (License, CI, TypeScript, React, Tailwind) — the CI badge points at ci.yml, which is registered and active.

Worth one line in the report, ⛔ not an edit: the badge block is unpinned by construction — the ci-cd-pipeline.md inventory pins cover content/docs/guide/ci-cd-pipeline.md, not the README, so it can drift again. If a cheap mechanical pin is obvious to you, report it as a finding; adding a new gate is out of this card's scope.

Gates

Hand-derived (objectui has no dispatch-gates.mjs); re-derive against your actual diff. A README-only change should need Lint and the docs/link checks (Check Links / Docs Links) at most — verify rather than assume, since README.md is a package-adjacent doc and the changeset-presence rule may treat it specially. Judge changeset vs skip-changeset against the repo's own rule and state which and why.

---

Generated by Claude Code

[yinlianghui-tw]

os-dev-report

{
 "issue": 5408,
 "status": "done",
 "branch": "claude/issue-5408-codeql-badge",
 "pr": "https://github.com/objectstack-ai/objectui/pull/5963",
 "premise_still_valid": true,
 "summary": "Deleted the stale CodeQL badge line (was README.md line 11) — both the badge image and its link target pointed at a workflow that does not exist. Reused the PM's already-settled fork ruling (case 1: CodeQL was never set up, per the dynamic-workflow listing with its positive control) and did not re-investigate it or add a CodeQL workflow. Scope held to README.md, that one line only; the other five badges and secret-scan.yml were left untouched.",
 "tests": "node scripts/check-doc-links.mjs -> 'Links are valid across 13 scan roots.' (README.md is a scan root; badge .svg URLs are explicitly out of the checker's disk-link scope per its own header, so this gate cannot regress from the deletion). node scripts/check-control-bytes.mjs -> OK, 4950 tracked text files scanned, 0 problems. pnpm run lint:root -> exit 0, 26 pre-existing @typescript-eslint/no-explicit-any warnings in unrelated test files, 0 errors, 0 new; ESLint does not lint .md files. node scripts/check-changeset-presence.mjs --base origin/main -> '0 file(s) ... under the src/ of a package the release covers' / 'No source of a released package changed in this range, so no changeset is owed.' (exit 0) -- README.md sits outside every package's src/, so the guarded surface never includes it; no changeset added, none owed, confirmed by running the gate itself rather than assumed. Check Links (Lychee) is schedule+workflow_dispatch only, not a PR gate, per its own header -- not run. All commands captured with redirect-then-capture (no piped $? reads). Final PR head f28d9928577ff1a78f95ef30f43da95d8168bfd7 (1 commit, 1 file changed, 1 deletion) -- gate runs above were against this same tree.",
 "open_questions": [],
 "out_of_scope_findings": [
 "filed as #5964: CONTRIBUTING.md's Security Scans section lists CodeQL as an active scan; same false-claim class as #5408, out of README-only file surface",
 "filed as #5965: packages/vscode-extension/SUMMARY.md claims 'CodeQL扫描通过' (a CodeQL scan passed); stronger false claim than the badge, likely a stale one-off status doc rather than maintained documentation -- flagged for triage rather than prescribed a fix"
 ]
}

---

Generated by Claude Code