ci: fix Scalpel fetch failure in shallow CI clones

Pre-fetch the base branch using git CLI in the workflow instead of
relying on Scalpel's JGit fetchBaseBranch=true. JGit's FetchCommand
crashes with MissingObjectException during fetchSubmodules in GitHub
Actions' shallow clones, even with fetchBaseBranch enabled.

- Remove persist-credentials: false so git fetch works after checkout
- Add "Fetch base branch" step using git CLI (handles shallow clones)
- Set scalpel.fetchBaseBranch=false (base branch already available)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: gnodet

.github/CI-ARCHITECTURE.md

@@ -131,7 +131,7 @@ Scalpel flags are set in `etc/scripts/regen.sh` when running in CI (`GITHUB_ACTI
 | --- | --- | --- |
 | `scalpel.mode` | `skip-tests` | Build all, test only affected |
 | `scalpel.skipTestsForUpstream` | `true` | Don't test upstream-only modules |
-| `scalpel.fetchBaseBranch` | `true` | Auto-fetch base branch in shallow clones |
+| `scalpel.fetchBaseBranch` | `false` | Base branch pre-fetched by workflow (git CLI handles shallow clones better than JGit) |
 | `scalpel.fullBuildTriggers` | *(empty)* | Override `.mvn/**` default |
 | `scalpel.reportFile` | `target/scalpel-report.json` | JSON report for PR comment |
 | `scalpel.impactedLog` | `target/scalpel-impacted.txt` | Simple module path list |

.github/workflows/pr-build-main.yml

@@ -76,8 +76,13 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          persist-credentials: false
           ref: ${{ inputs.pr_ref || '' }}
+      - name: Fetch base branch for Scalpel change detection
+        if: ${{ !inputs.skip_full_build }}
+        run: |
+          # Scalpel needs the base branch to detect changes.
+          # git CLI handles shallow clones reliably (JGit's fetchSubmodules does not).
+          git fetch --no-tags --depth=200 origin "${GITHUB_BASE_REF:-main}:refs/remotes/origin/${GITHUB_BASE_REF:-main}"
       - id: install-packages
         uses: ./.github/actions/install-packages
       - id: install-mvnd

.github/workflows/sonar-build.yml

@@ -43,9 +43,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
+      - name: Fetch base branch for Scalpel change detection
+        run: |
+          git fetch --no-tags --depth=200 origin "${GITHUB_BASE_REF:-main}:refs/remotes/origin/${GITHUB_BASE_REF:-main}"
       - id: install-packages
         uses: ./.github/actions/install-packages
 

etc/scripts/regen.sh

@@ -39,7 +39,7 @@ rm -Rf **/src/generated/
 # On developer machines, Scalpel auto-disables (no GITHUB_BASE_REF).
 scalpel_flags=""
 if [ "${GITHUB_ACTIONS:-}" = "true" ] && [ -z "$skip_tests" ]; then
-  scalpel_flags="-Dscalpel.mode=skip-tests -Dscalpel.skipTestsForUpstream=true -Dscalpel.fetchBaseBranch=true -Dscalpel.fullBuildTriggers= -Dscalpel.reportFile=target/scalpel-report.json -Dscalpel.impactedLog=target/scalpel-impacted.txt"
+  scalpel_flags="-Dscalpel.mode=skip-tests -Dscalpel.skipTestsForUpstream=true -Dscalpel.fetchBaseBranch=false -Dscalpel.fullBuildTriggers= -Dscalpel.reportFile=target/scalpel-report.json -Dscalpel.impactedLog=target/scalpel-impacted.txt"
 fi
 
 extra_flags=""