// wiki / code-references

Code References

New

Find old feature flags, remove their source-code branches safely, and archive them only after repository references and dependency blockers are gone.

What the feature does

Code References is a flag-retirement workflow. A small CLI scanner runs in your repository's CI pipeline and reports where known Maxlona flag keys appear. Maxlona combines those locations with recent evaluations, lifecycle state, the value served by each environment, and flag dependencies.

Find

See every reference

Repository, branch, commit, file, line, and a source-host link when one can be determined.

Decide

Understand readiness

Distinguish flags still in code, still evaluated, blocked by dependencies, or ready to archive.

Remove

Retire safely

Keep the permanent code path, remove the flag lookup, deploy, confirm it disappeared, then archive.

What it does not do

It does not clone or browse repositories from the web app. Source locations arrive only from the scanner that you choose to run in CI.

It does not change source code. Your team reviews and merges the branch cleanup in its normal development workflow.

It does not archive flags during a scan. The scanner uses a read-only Management Key; archiving is a separate authorized action.

It does not prove that a deployment is complete. A removed key that is still evaluated usually means an older service or client remains active.

Set up repository scanning

  1. 1

    Create a read-only Management Key

    A key restricted to one application scans only flags in that application. Store it in CI as MAXLONA_MANAGEMENT_KEY.

  2. 2

    Preview a local scan

    Run from the repository root. Dry-run mode prints findings and uploads nothing.

    npx --yes @maxlona/code-refs@1 --dry-run
  3. 3

    Run it after merges to the main branch

    Each successful scan replaces the previous report for that repository and branch.

    # GitHub Actions step
- uses: actions/setup-node@v4
  with: { node-version: 20 }
- run: npx --yes @maxlona/code-refs@1
  env:
    MAXLONA_MANAGEMENT_KEY: ${{ secrets.MAXLONA_MANAGEMENT_KEY }}

    Azure Pipelines, GitLab CI, command-line, self-hosted URL, exclusions, JSON output, and archived-reference checks are also supported. The signed-in Code References page generates the matching snippet.

The complete cleanup flow

Treat removal as a sequence, not a single delete button.

  1. Step 1

    Merge code

    Normal development reaches the main branch.

  2. Step 2

    Scan

    CI reports current flag-key locations.

  3. Step 3

    Review

    Maxlona combines code, traffic, and dependencies.

  4. Step 4

    Remove

    Keep the permanent path and delete the flag branch.

  5. Step 5

    Confirm

    A later scan shows the key is gone.

  6. Step 6

    Archive

    Turn off and hide the retired flag safely.

How to read Cleanup

StateMeaningNext action
Ready to archiveThe key is gone from scanned code and no dependency blocks removal.Review serving behavior, then archive.
Remove codeOne or more active repository reports still contain the key.Open the flag's Code References tab and clean those locations.
Still evaluatedThe key is absent from code but runtime traffic still asks for it.Find an older deployment, background job, mobile client, or unscanned repository.
BlockedAnother flag depends on it or a safety condition needs attention.Resolve the linked blocker before archiving.

What the scanner recognizes

The scanner matches known flag keys written as quoted string literals. If your application keeps keys in constants, the constant definition is the reference. It respects .gitignore and skips dependency folders, build output, minified files, and binary content. Use repeatable --exclude options for organization-specific generated or test paths.

Related
Feature flags →Audit log →Management Keys & RBAC →