STF-1604: Analyze the merge commit in CodeQL on pull requests

[oschwald]

The CodeQL init step warns on every run:

1 issue was detected with this workflow: git checkout HEAD^2 is no longer necessary. Please remove this step as Code Scanning recommends analyzing the merge commit for best results.

This removes the git checkout HEAD^2 step and the fetch-depth: 2 it needed. On pull requests, CodeQL now analyzes the merge commit that actions/checkout fetches by default. The init, autobuild, and analyze steps are unchanged.

This PR's own CodeQL run should show no warning in the "Initialize CodeQL" step.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated the automated code analysis workflow’s pull request checkout behavior.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: e59623d3-4127-4341-9068-c718f5ea98e2

📥 Commits

Reviewing files that changed from the base of the PR and between 21dfc89 and 99e4659.

📒 Files selected for processing (1)

• .github/workflows/codeql-analysis.yml

💤 Files with no reviewable changes (1)

• .github/workflows/codeql-analysis.yml

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

The CodeQL workflow removes the explicit fetch depth and pull-request-only checkout step. It retains persist-credentials: false.

Changes

CodeQL checkout

Layer / File(s)	Summary
Checkout settings .github/workflows/codeql-analysis.yml	The checkout step retains persist-credentials: false and removes fetch-depth: 2 and the pull-request-only git checkout HEAD^2 step.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 99e46

The workflow removes custom checkout behavior while retaining the CodeQL steps and credential protection. No actionable merge-blocking issue was identified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: CodeQL will analyze the merge commit on pull requests.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks out in the moonlit night
The workflow follows its default path right
No shallow depth is set in the flow
No extra head checkout follows
The rabbit hops off, content to go}

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Copilot review overview

🟢 Approval recommended

The focused workflow change correctly removes obsolete checkout configuration without affecting analysis steps.

Review effort: Balanced
Findings: None

What changed in this PR

Updates CodeQL pull request scanning to analyze the default merge commit.

Changes:

• Removes the manual PR-head checkout.
• Removes the unnecessary shallow fetch configuration.

File	Description
.github/​workflows/​codeql-analysis.yml	Simplifies checkout behavior for CodeQL scans.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.