STF-1604: Analyze the merge commit in CodeQL on pull requests

[oschwald]

The CodeQL init step warns on every run:

1 issue was detected with this workflow: git checkout HEAD^2 is no longer necessary. Please remove this step as Code Scanning recommends analyzing the merge commit for best results.

This removes the git checkout HEAD^2 step and the fetch-depth: 2 it needed. On pull requests, CodeQL now analyzes the merge commit that actions/checkout fetches by default. The init, autobuild, and analyze steps are unchanged.

This PR's own CodeQL run should show no warning in the "Initialize CodeQL" step.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated the pull-request checkout behavior used by automated code analysis. Pull requests now use the checkout action’s default revision and fetch-depth settings, while credential persistence remains disabled. This changes how the analysis workflow obtains source code; no changes to application features or user-facing behavior are included.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: a6bb7e41-ba05-4e18-974a-0926eb9dce20

📥 Commits

Reviewing files that changed from the base of the PR and between 9da00bf and 4229bd3.

📒 Files selected for processing (1)

• .github/workflows/codeql-analysis.yml

💤 Files with no reviewable changes (1)

• .github/workflows/codeql-analysis.yml

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

The CodeQL workflow checkout step retains persist-credentials: false and removes the explicit fetch depth and pull-request checkout of HEAD^2.

Changes

CodeQL workflow checkout

Layer / File(s)	Summary
Checkout settings .github/workflows/codeql-analysis.yml	The checkout step retains disabled credential persistence. It no longer sets fetch-depth: 3 or checks out HEAD^2 for pull requests.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 4229b

CodeQL now analyzes the intended pull-request merge commit. The remaining analysis steps are unchanged, and the change is mergeable after normal checks.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: CodeQL will analyze the merge commit for pull requests.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the workflow’s trail,
No pinned ref or fetch-depth tale.
Credentials stay asleep and still,
The default checkout does its will.
One hop, one step, across the dale.}

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Modver result

This report was generated by Modver,
a Go package and command that helps you obey semantic versioning rules in your Go module.

This PR does not require a change in your module’s version number.
(You might still consider bumping the patchlevel anyway.)

[Copilot]

Copilot review overview

🟢 Approval recommended

The targeted workflow change is correct, and checkout and CodeQL initialization succeeded on the PR run.

Review effort: Balanced
Findings: None

What changed in this PR

Updates CodeQL pull-request analysis to scan the default merge commit.

Changes:

• Removes the custom fetch depth and PR-head checkout.
• Retains disabled credential persistence.

File	Description
.github/​workflows/​codeql-analysis.yml	Uses the checkout action’s default PR merge commit.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.