STF-1604: Analyze the merge commit in CodeQL on pull requests

[oschwald]

The CodeQL init step warns on every run:

1 issue was detected with this workflow: git checkout HEAD^2 is no longer necessary. Please remove this step as Code Scanning recommends analyzing the merge commit for best results.

This removes the git checkout HEAD^2 step and the fetch-depth: 2 it needed. On pull requests, CodeQL now analyzes the merge commit that actions/checkout fetches by default. The init, autobuild, and analyze steps are unchanged.

This PR's own CodeQL run should show no warning in the "Initialize CodeQL" step.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated the automated code analysis workflow to use the checkout action’s default fetch depth and pull-request ref. Credential persistence remains disabled.
  • No changes to application functionality or end-user features.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: d046adce-e600-4434-bf15-f0fb2950efe3

📥 Commits

Reviewing files that changed from the base of the PR and between 473552d and 58a5d3a.

📒 Files selected for processing (1)

• .github/workflows/codeql-analysis.yml

💤 Files with no reviewable changes (1)

• .github/workflows/codeql-analysis.yml

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

The CodeQL workflow now uses the checkout action’s default fetch depth and event ref. It retains persist-credentials: false.

Changes

CodeQL workflow

Layer / File(s)	Summary
Use default checkout settings .github/workflows/codeql-analysis.yml	The checkout step no longer sets fetch-depth or switches pull-request runs to HEAD^2. It retains persist-credentials: false.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 58a5d

The workflow now analyzes the pull-request merge commit as intended. No actionable merge-blocking risk was identified; normal CI checks remain appropriate.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: CodeQL will analyze the merge commit on pull requests. It matches the workflow changes and the stated PR objective.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks out the code with care,
No extra commits are fetched there.
The event’s ref stays in its place,
Credentials keep their guarded space.
Then hops away through moonlit air.}

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Copilot review overview

🟢 Approval recommended

The workflow now follows CodeQL’s recommended pull request checkout behavior without affecting other analysis steps.

Review effort: Balanced
Findings: None

What changed in this PR

Updates CodeQL pull request scans to analyze GitHub’s default merge commit.

Changes:

• Removes the custom PR head checkout.
• Restores the checkout action’s default fetch depth.

File	Description
.github/​workflows/​codeql-analysis.yml	Simplifies checkout configuration for merge-commit analysis.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.