Uh oh!
There was an error while loading. Please reload this page.
docs(readme): remove stale CodeQL badge - #5963
Merged
Merged
Conversation
Both the badge image and its link target (`actions/workflows/codeql.yml`) point at a workflow that does not exist in this repository. Verified against the live workflow listing: 31 registered workflows, four `dynamic/*` entries (Copilot swe-agent, Copilot PR reviewer, Dependabot, Claude), and no `dynamic/github-code-scanning/codeql` — the shape CodeQL default setup registers when enabled, and the other four dynamic entries are the positive control proving the listing surfaces them. CodeQL was never set up here; the badge was false. Secret scanning (`.github/workflows/secret-scan.yml`) remains active and unaffected. Whether this repo should adopt CodeQL is a separate decision, out of scope for this fix. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019b5UBNMtTzKbVtZZGvFuxe
yinlianghui-tw
marked this pull request as ready for review
August 24, 2026 09:42
Uh oh!
There was an error while loading. Please reload this page.
This was referenced Aug 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes#5408
What
Removes the
CodeQLbadge line fromREADME.md(was line 11). Both halves —the badge image (
workflows/CodeQL%20Security%20Scan/badge.svg) and the linktarget (
actions/workflows/codeql.yml) — pointed at a workflow that does notexist in this repository.
Verification (case 1 confirmed: CodeQL was never set up)
GET /repos/objectstack-ai/objectui/actions/workflowsreturns 31 registeredworkflows. Four are
dynamic/*: Copilot swe-agent, Copilot PR reviewer,Dependabot, and the Claude agent. There is no
dynamic/github-code-scanning/codeql— the entry CodeQL "default setup"registers when enabled in repository Security settings. The other four
dynamic entries are the positive control proving the listing does surface
dynamic workflows, so this absence is a reading, not a broken query.
The repo is not unscanned:
.github/workflows/secret-scan.yml("SecretScanning") is registered and active, unaffected by this change and untouched
by this PR.
Whether this repo should adopt CodeQL is a separate, maintainer-floor
decision — out of scope here and not implemented.
Scope
README.mdonly, and within it only the CodeQL badge line. The other fivebadges (License, CI, TypeScript, React, Tailwind) are untouched; the CI badge
points at
ci.yml, which is registered and active.Gates
pnpm run lint:root): exit 0, 26 pre-existing warnings (all@typescript-eslint/no-explicit-anyin unrelated test files), 0 errors.ESLint does not lint
.mdfiles, so this change is not itself linted by it.node scripts/check-doc-links.mjs):Links are valid across 13 scan roots.The rootREADME.mdis one of the 13 scan roots, but badgeworkflows/<name>/badge.svgURLs are github.com web routes rather thantree paths and are explicitly out of scope for this checker (see its header,
"Only
blob|tree" boundary) — deleting the line cannot regress this gate.schedule+workflow_dispatchonly,not a PR gate (deliberate — see the workflow's own header).
node scripts/check-control-bytes.mjs): OK, 4950 trackedtext files scanned.
check-changeset-presence.mjsonly guards
<pkg>/src/**for packages in.changeset/config.json'sfixedgroup;README.mdis at the repo root, outside every packagedirectory, so it is not part of the guarded surface at all (ran the gate
locally against this diff:
0 file(s) ... under the src/ of a package the release covers, exit 0).Finding (not fixed here — out of file-surface scope for this card)
Two more stale CodeQL claims exist elsewhere in the repo, same defect class,
left unfixed per this card's
README.md-only file surface:CONTRIBUTING.mdlists CodeQL under "Security Scans" as if it runs.packages/vscode-extension/SUMMARY.mdclaims "CodeQL扫描通过" (CodeQL scanpassed).
Filed as separate, unassigned issues (see linked report).
Generated by Claude Code