ci: check out base repo in clang-tidy-bazel-post so reviewdog finds .git

Reviewdog's github-pr-review reporter resolves the local git root before
flushing comments. On a fresh runner containing only the downloaded
artifact, reviewdog logs "reviewdog: .git not found" and silently no-ops
(exit 0, no review posted). Confirmed locally by running reviewdog from a
scratch dir against the same synthesized event + artifact: zero comments
posted; running the same command from inside a checkout works.

Add a shallow actions/checkout step before the artifact download. The
default ref in workflow_run context is the base repo's default branch,
which is safe (no fork code) and sufficient — reviewdog fetches the
actual PR diff via the GitHub API, so the local SHA need not match.

Signed-off-by: Joao Luis Sombrio <sombrio@sombrasoft.dev>

Author: sombraSoft

.github/workflows/github-actions-clang-tidy-bazel-post.yml

@@ -28,6 +28,20 @@ jobs:
     if: ${{ github.event.workflow_run.conclusion == 'success' }}
     runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && 'self-hosted' || 'ubuntu-latest' }}
     steps:
+      # Reviewdog's github-pr-review reporter resolves the local git root
+      # before flushing comments and silently no-ops if .git is missing.
+      # Check out the base repo (default branch, shallow) so reviewdog has
+      # a .git directory to operate against. No fork code involved — this
+      # is the base repo at HEAD of its default branch.
+      - name: Check out base repo for reviewdog .git requirement
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 1
+          # Default ref in workflow_run context is the base repo's default
+          # branch, which is the safe choice here. Reviewdog uses GitHub
+          # API to fetch the actual PR diff, so the local SHA need not
+          # match the PR head.
+
       - name: Download clang-tidy artifact
         uses: actions/download-artifact@v4
         with: