[oschwald]

The CodeQL init step warns on every run:

1 issue was detected with this workflow: git checkout HEAD^2 is no longer necessary. Please remove this step as Code Scanning recommends analyzing the merge commit for best results.

This removes the git checkout HEAD^2 step and the fetch-depth: 2 it needed. On pull requests, CodeQL now analyzes the merge commit that actions/checkout fetches by default. The init, autobuild, and analyze steps are unchanged.

This PR's own CodeQL run should show no warning in the "Initialize CodeQL" step.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated how automated code analysis handles pull requests. This change affects the project’s internal validation process and does not change any user-facing functionality.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: b008bfee-cbeb-4264-b651-a88ebbf1865b

📥 Commits

Reviewing files that changed from the base of the PR and between 03b989d and 5a02f1b.

📒 Files selected for processing (1)

• .github/workflows/codeql-analysis.yml

💤 Files with no reviewable changes (1)

• .github/workflows/codeql-analysis.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The CodeQL workflow removes the checkout fetch-depth setting and the pull-request-only step that explicitly checked out HEAD^2. The checkout step retains persist-credentials: false.

Changes

CodeQL workflow

Layer / File(s)	Summary
Workflow checkout behavior .github/workflows/codeql-analysis.yml	The checkout step retains persist-credentials: false. The workflow removes the fetch-depth setting and the pull-request-only git checkout HEAD^2 step.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 5a02f

The workflow now analyzes the pull-request merge result as intended. No actionable merge-blocking risk was identified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: CodeQL will analyze the merge commit for pull requests after the workflow removes the manual checkout of HEAD^2.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checked the workflow file,
And found fewer checkout steps in its pile.
The credentials stay asleep,
While default refs the checkout will keep.
Then off it hops, content with the change.}

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Copilot review overview

🟢 Approval recommended

The focused workflow change correctly removes obsolete checkout behavior without affecting the scan steps.

Review effort: Balanced
Findings: None

What changed in this PR

Updates CodeQL pull-request scans to analyze the default merge commit and removes the obsolete warning.

Changes:

• Removes the custom fetch depth and PR-head checkout step.
• Leaves CodeQL initialization, build, and analysis unchanged.

File	Description
.github/​workflows/​codeql-analysis.yml	Uses the default merge-commit checkout behavior.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.