From 1944385ab0ee5a82a6ae9a6673eca19a091d391f Mon Sep 17 00:00:00 2001 From: Gregory Oschwald Date: Thu, 1 Oct 2026 22:51:11 +0000 Subject: [PATCH] Analyze the merge commit in CodeQL on pull requests Remove the git checkout HEAD^2 step and the fetch-depth it needed. The CodeQL init action warns that the step is no longer necessary, and code scanning recommends analyzing the merge commit, which actions/checkout fetches by default. Co-Authored-By: Claude Haiku 4.5 --- .github/workflows/codeql-analysis.yml | 8 -------- 1 file changed, 8 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 672a37d..a4e889a 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -17,16 +17,8 @@ jobs: - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: - # We must fetch at least the immediate parents so that if this is - # a pull request then we can checkout the head. - fetch-depth: 2 persist-credentials: false - # If this run was triggered by a pull request event, then checkout - # the head of the pull request instead of the merge commit. - - run: git checkout HEAD^2 - if: ${{ github.event_name == 'pull_request' }} - # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1