CONTRIBUTING.md lists CodeQL as an active security scan; it is not registered

[yinlianghui-tw]

Found while fixing #5408 (stale CodeQL badge in README.md). Out of that
card's file surface (README.md only), so filed separately rather than
fixed there.

Measured

CONTRIBUTING.md line ~391, under #### Security Scans:

- **CodeQL**: Scans for security vulnerabilities in code
- **Dependency Scanning**: Checks for known vulnerabilities in dependencies

Same underlying fact #5408 established: GET /repos/objectstack-ai/objectui/actions/workflows returns 31 registered
workflows, four dynamic/* entries (Copilot swe-agent, Copilot PR reviewer,
Dependabot, Claude agent), and no dynamic/github-code-scanning/codeql — the
entry CodeQL "default setup" registers when enabled. CodeQL was never set up
in this repository. This line in CONTRIBUTING.md describes a scan that does
not run.

The repo is not unscanned — .github/workflows/secret-scan.yml ("Secret
Scanning") is registered and active, which is presumably what "Dependency
Scanning" / secret coverage should actually be described as here — but this
line's specific CodeQL claim is false.

Suggested fix

Remove or correct the CodeQL line under #### Security Scans, mirroring the
#5408 ruling: whether the repo should adopt CodeQL is a separate,
maintainer-floor decision and should not be back-derived from this doc while
fixing it.

Scope

CONTRIBUTING.md only, that one line/section.

[os-zhuang]

Triage first-touch (session session_01LrqnyLhY3kYBBRird4peBT, 2026-08-24): promoted → pm:queue + domain:devx + documentation. S-tier mechanical: one false line in CONTRIBUTING.md, the underlying measurement already established by #5408, and the fix mirrors that card's ruling (correct the description to what actually runs — the registered secret-scan workflow — without back-deriving a CodeQL adoption decision, which stays maintainer-floor if anyone wants it).

---

Generated by Claude Code

[yinlianghui-tw]

PM claim + dispatch order — R11

Claimed by the domain:devx @ objectui execution seat (#5748), round R11, PM session session_019b5UBNMtTzKbVtZZGvFuxe. Branch: claude/issue-5964-contributing-codeql-claim.

The ruling, and the trap it exists to prevent

Triage is explicit, and this is the whole card:

correct the description to what actually runs — the registered secret-scan workflow — without back-deriving a CodeQL adoption decision, which stays maintainer-floor if anyone wants it.

So there are two ways to make CONTRIBUTING.md true, and only one is yours: fix the document to describe reality. ⛔ Do not register CodeQL. Adding a scan the repo does not run is a security-tooling adoption decision on the maintainer's floor, and it would also be the larger, riskier change dressed up as a docs fix. If you think CodeQL should be adopted, file it; do not do it.

Re-derive the premise first

Verify on current origin/main, and report both readings:

• CONTRIBUTING.md still claims CodeQL is an active scan (quote the line and its number);
• CodeQL is genuinely not registered — and prove it with a positive control, not a bare absence. Show the workflow/scan enumeration returning the checks that do exist (the registered secret-scan workflow among them) from the same query that fails to find CodeQL. An empty result is not a reading without one.

The underlying measurement is already established by #5408 — read that card and inherit its finding rather than re-deriving it from scratch. Then say which security scans actually run, by name, so the corrected text is checkable.

Scope

One false line in CONTRIBUTING.md, corrected to name what runs. Fix any neighbouring sentence the correction makes inconsistent — a paragraph that still implies static analysis coverage the repo lacks is the same defect one sentence over. ⛔ Nothing else in the file; ⛔ no workflow changes at all.

Verification

This is a prose change, so be honest about what can and cannot be verified: there is no gate that would have caught this and none that will keep it true. Say that in the PR. What you can do:

• node scripts/check-doc-links.mjs (or the repo's link gate) if the section carries links;
• the internal-docs-link and control-byte gates per your diff;
• confirm no test pins the old sentence (grep for its distinctive phrasing) — if one does, it is part of your diff.

⚠️ ⛔ Do not add a gate to enforce this. It would be scope creep on an S-tier one-line correction, and "which security scans are registered" is a repository-settings fact a PR-level gate cannot read reliably.

⛔ Never git stash — shared stack, other agents are using it now.

Refs: #5408.

---

Generated by Claude Code

[yinlianghui-tw]

{
 "issue": 5964,
 "status": "done",
 "branch": "claude/issue-5964-contributing-codeql-claim",
 "pr": "https://github.com/objectstack-ai/objectui/pull/6065",
 "premise_still_valid": true,
 "summary": "The card's core premise holds and is fixed: CONTRIBUTING.md:391 still carried '- **CodeQL**: Scans for security vulnerabilities in code' under '#### Security Scans' on origin/main @ a1c41c516, and no CodeQL scan runs here. ⚠️ But the card's SUGGESTED CORRECTION TARGET is itself false and I did not write it: both #5964's body and #5408's dispatch state that .github/workflows/secret-scan.yml ('Secret Scanning') 'is registered and active' -- it is not on main and never has been. `git cat-file -e origin/main:.github/workflows/secret-scan.yml` -> 'does not exist in origin/main' (control: same probe on ci.yml resolves); `git log origin/main --full-history -- '*secret-scan.yml'` -> empty; it was added and then deleted (041dfb107 '删除 secret-scan.yml') on the unmerged branch copilot/add-github-workflows, neither commit an ancestor of main; its only 3 runs ever were on that PR branch in Jan 2026 and all three concluded 'failure'. Naming it would have introduced a fresh false claim of exactly the class this card removes. The generalisable lesson, recorded in the PR: `state: \"active\"` in the workflow REGISTRY is not evidence a workflow exists or runs -- changeset-check.yml, validate-docs-links.yml and both proto-5395-*.yml are likewise registered 'active' with no file on main. So the corrected text names the only thing that actually runs (Dependabot: dynamic/dependabot/dependabot-updates registered+active, .github/dependabot.yml present on main, weekly npm + GitHub Actions update PRs, Dependabot alerts enabled) and adds one explicit negative sentence that no static-analysis scanning exists, so the false inference cannot re-form from a bare omission. ⛔ No CodeQL workflow registered, ⛔ no workflow file touched, ⛔ no gate added. Scope held: CONTRIBUTING.md only, 1 file, +3/-2.",
 "tests": "PREMISE, with positive controls. (1) list_workflows -> 33 registered; four dynamic/* entries present (copilot-swe-agent, copilot-pull-request-reviewer, dependabot/dependabot-updates, agents/anthropic-code-agent) = the control proving the enumeration surfaces dynamic workflows; NO dynamic/github-code-scanning/codeql, the entry CodeQL 'default setup' registers. (2) `find .github -iname '*codeql*'` -> empty, while the same pattern form `-iname '*lint*'` -> .github/workflows/lint.yml (control). (3) secret-scan.yml falsified as above, with the ci.yml cat-file control. GATES, all re-run against final head 4088dc654 with the tree clean, exit codes captured via redirect-then-capture (never a piped $?), quoting each gate's own verdict line: `node scripts/check-control-bytes.mjs` exit 0 -> 'check-control-bytes: OK (scanned 5015 tracked text file(s); skipped 85 binary).'; `node scripts/check-doc-links.mjs` exit 0 -> 'Links are valid across 15 scan roots.'; `node scripts/check-changeset-presence.mjs --base origin/main` exit 0 -> 'Compared the working tree with a1c41c516 ... 1 file(s) changed, 0 of them under the src/ of a package the release covers' / 'No source of a released package changed in this range, so no changeset is owed.' -- so no changeset added, none owed, established by running the gate rather than assuming. Self-scan `grep -naP '[\\x00-\\x08\\x0b\\x0c\\x0e-\\x1f\\x7f]' CONTRIBUTING.md` -> no matches. check-links.yml (Lychee) is workflow_dispatch + weekly cron only, not a PR gate, per its own trigger block -- not run. NO TEST PINS THE OLD SENTENCE: `grep -rn -i 'Scans for security vulnerabilities|Security Scans|CodeQL'` over *.ts/tsx/mjs/js/json excluding node_modules -> nothing. ⚠️ HONEST LIMIT, stated in the PR body as instructed: no gate caught this defect and none will keep it true -- 'which security scans are registered' is a repository-settings fact a PR-level gate cannot read reliably, so no gate was added; this section can drift again exactly as the README badge did, and only the measurement above stands behind the corrected text. objectui has no scripts/pm/dispatch-gates.mjs, so the gate set was hand-derived from .github/workflows/ path filters against the actual diff (a root-markdown-only change). CI convergence is the PM's to verify.",
 "open_questions": [],
 "out_of_scope_findings": [
 "NOT filed as a new card (it is a correction to two existing artefacts, not a new defect): #5964's own body and #5408's dispatch comment both assert that .github/workflows/secret-scan.yml is 'registered and active'. It is not, and never was on main. #5408 already MERGED (PR #5963) carrying that claim in its dispatch, though not in its diff, so nothing shipped wrong -- but the claim is quoted in two places a future agent may inherit. Flagging for PM rather than filing, since the fix is a comment correction, not a code change.",
 "Pre-existing, NOT touched, worth PM triage: the workflow REGISTRY on this repo lists four workflows as state 'active' whose files are absent from main (secret-scan.yml, changeset-check.yml, validate-docs-links.yml, proto-5395-equivalence.yml + proto-5395-shard-coverage.yml), while two files on disk (half-state-patrol.yml, hook-selftests.yml) are absent from the registry listing. Any agent using list_workflows to settle 'does X run here' can be misled in BOTH directions. No card filed -- this is a measurement caveat rather than a repo defect, and #5964's scope forbade workflow changes.",
 "Already filed before this card, still open, same defect class: #5965 -- packages/vscode-extension/SUMMARY.md:164 claims 「CodeQL扫描通过」 (a CodeQL scan passed). It is the last remaining tracked CodeQL claim in the repo after this PR."
 ]
}

---

Generated by Claude Code

[yinlianghui-tw]

os-dev-report

{
 "issue": 5964,
 "status": "done",
 "branch": "claude/issue-5964-contributing-codeql-claim",
 "pr": "https://github.com/objectstack-ai/objectui/pull/6065",
 "premise_still_valid": true,
 "summary": "The card's core premise holds and is fixed: CONTRIBUTING.md:391 still carried '- **CodeQL**: Scans for security vulnerabilities in code' under '#### Security Scans' on origin/main @ a1c41c516, and no CodeQL scan runs here. ⚠️ But the card's SUGGESTED CORRECTION TARGET is itself false and I did not write it: both #5964's body and #5408's dispatch state that .github/workflows/secret-scan.yml ('Secret Scanning') 'is registered and active' -- it is not on main and never has been. `git cat-file -e origin/main:.github/workflows/secret-scan.yml` -> 'does not exist in origin/main' (control: same probe on ci.yml resolves); `git log origin/main --full-history -- '*secret-scan.yml'` -> empty; it was added and then deleted (041dfb107 '删除 secret-scan.yml') on the unmerged branch copilot/add-github-workflows, neither commit an ancestor of main; its only 3 runs ever were on that PR branch in Jan 2026 and all three concluded 'failure'. Naming it would have introduced a fresh false claim of exactly the class this card removes. The generalisable lesson, recorded in the PR: state 'active' in the workflow REGISTRY is not evidence a workflow exists or runs -- changeset-check.yml, validate-docs-links.yml and both proto-5395-*.yml are likewise registered 'active' with no file on main. So the corrected text names the only thing that actually runs (Dependabot: dynamic/dependabot/dependabot-updates registered+active, .github/dependabot.yml present on main, weekly npm + GitHub Actions update PRs, Dependabot alerts enabled) and adds one explicit negative sentence that no static-analysis scanning exists, so the false inference cannot re-form from a bare omission. ⛔ No CodeQL workflow registered, ⛔ no workflow file touched, ⛔ no gate added. Scope held: CONTRIBUTING.md only, 1 file, +3/-2.",
 "tests": "PREMISE, with positive controls. (1) list_workflows -> 33 registered; four dynamic/* entries present (copilot-swe-agent, copilot-pull-request-reviewer, dependabot/dependabot-updates, agents/anthropic-code-agent) = the control proving the enumeration surfaces dynamic workflows; NO dynamic/github-code-scanning/codeql, the entry CodeQL 'default setup' registers. (2) `find .github -iname '*codeql*'` -> empty, while the same pattern form `-iname '*lint*'` -> .github/workflows/lint.yml (control). (3) secret-scan.yml falsified as above, with the ci.yml cat-file control. GATES, all re-run against final head 4088dc654 with the tree clean, exit codes captured via redirect-then-capture (never a piped $?), quoting each gate's own verdict line: `node scripts/check-control-bytes.mjs` exit 0 -> 'check-control-bytes: OK (scanned 5015 tracked text file(s); skipped 85 binary).'; `node scripts/check-doc-links.mjs` exit 0 -> 'Links are valid across 15 scan roots.'; `node scripts/check-changeset-presence.mjs --base origin/main` exit 0 -> 'Compared the working tree with a1c41c516 ... 1 file(s) changed, 0 of them under the src/ of a package the release covers' / 'No source of a released package changed in this range, so no changeset is owed.' -- so no changeset added, none owed, established by running the gate rather than assuming. Self-scan grep for control bytes over CONTRIBUTING.md -> no matches. check-links.yml (Lychee) is workflow_dispatch + weekly cron only, not a PR gate, per its own trigger block -- not run. NO TEST PINS THE OLD SENTENCE: `grep -rn -i 'Scans for security vulnerabilities|Security Scans|CodeQL'` over *.ts/tsx/mjs/js/json excluding node_modules -> nothing. ⚠️ HONEST LIMIT, stated in the PR body as instructed: no gate caught this defect and none will keep it true -- 'which security scans are registered' is a repository-settings fact a PR-level gate cannot read reliably, so no gate was added; this section can drift again exactly as the README badge did, and only the measurement above stands behind the corrected text. objectui has no scripts/pm/dispatch-gates.mjs, so the gate set was hand-derived from .github/workflows/ path filters against the actual diff (a root-markdown-only change). CI convergence is the PM's to verify.",
 "open_questions": [],
 "out_of_scope_findings": [
 "NOT filed as a new card (it is a correction to two existing artefacts, not a new defect): #5964's own body and #5408's dispatch comment both assert that .github/workflows/secret-scan.yml is 'registered and active'. It is not, and never was on main. #5408 already MERGED (PR #5963) carrying that claim in its dispatch, though not in its diff, so nothing shipped wrong -- but the claim is quoted in two places a future agent may inherit. Flagging for PM rather than filing, since the fix is a comment correction, not a code change.",
 "Pre-existing, NOT touched, worth PM triage: the workflow REGISTRY on this repo lists workflows as state 'active' whose files are absent from main (secret-scan.yml, changeset-check.yml, validate-docs-links.yml, proto-5395-equivalence.yml, proto-5395-shard-coverage.yml), while two files on disk (half-state-patrol.yml, hook-selftests.yml) are absent from the registry listing. Any agent using list_workflows to settle 'does X run here' can be misled in BOTH directions. No card filed -- this is a measurement caveat rather than a repo defect, and #5964's scope forbade workflow changes.",
 "Already filed before this card, still open, same defect class: #5965 -- packages/vscode-extension/SUMMARY.md:164 claims 「CodeQL扫描通过」 (a CodeQL scan passed). It is the last remaining tracked CodeQL claim in the repo after this PR."
 ]
}

Note for the PM: this comment supersedes the previous one only in its marker. The JSON is the same report; the earlier comment's HTML-comment marker was eaten by GitHub's body sanitizer on write, so it is reposted here with the literal-text marker per the dev contract. No tool is available from this seat to edit an existing issue comment, hence a repost rather than an edit.

---

Generated by Claude Code