Set up instructions clarification

[myoung34]

The docs mention using this in the workflow:

    - name: Checkout repository
      uses: actions/checkout@v2
      with:
        # We must fetch at least the immediate parents so that if this is
        # a pull request then we can checkout the head.
        fetch-depth: 2
    # If this run was triggered by a pull request event, then checkout
    # the head of the pull request instead of the merge commit.
    - run: git checkout HEAD^2
      if: ${{ github.event_name == 'pull_request' }}

Is this mandatory? Are there side-effects to only using: - uses: actions/checkout@v2

[robertbrignull]

When an action runs on a pull request it runs on a merge commit, created internally by merging the PR into the base branch.
That bit in the workflow that you posted above means that when running on a pull request it'll run analysis on the head commit instead of the merge commit. The reason for this is that line numbers may have changed during the merge, and we want to attach any annotation to the head commit instead of the merge commit because it's hard to view the merge commit in the user interface.

We recommend that you keep it like that for now. This recommendation may be changing in the future, but it's not yet decided when, so there's not much you can do except be forewarned. You may want to put the codeql analysis in its own job instead of on the end of an existing job, if the above checkout would be an issue for that other job.

[myoung34]

Good point, ill refactor so i can keep the others the way they have been. thanks for clarifying