[jamescrosswell]

Summary

The format-code bot's auto-commit has been dragging submodule pointers into PR branches. For example, 8d97243 ("Format code") on #5664 also moved modules/sentry-cocoa and modules/sentry-native to main's pointers.

format-code.yml checked out the pull_request merge ref with submodules: recursive, so the submodule working trees sat at main's pointers. commit-formatted-code.sh then ran git checkout $GITHUB_HEAD_REF, which doesn't move submodule working trees, and git commit -am staged the mismatch as gitlink changes. This is the same failure CLAUDE.md warns about for git add -A.

It has happened on #5664, #5384, #5138, #5159 and #5238. A dragged pointer adds noise to the diff. If main bumps that submodule again before the PR merges, the squash merge conflicts on the gitlink, and resolving the conflict in the PR's favour silently reverts the bump.

There are two changes:

• format-code.yml checks out pull_request.head.sha, the same as verify-api.yml. The formatter then runs on the tree the commit lands on, not on PR+main.
• commit-formatted-code.sh stages only changes outside modules/. If the branch is pushed while the job runs (say, main merged in with a submodule bump), git checkout moves to a tip whose pointers differ from the working trees. With the old -a, that would revert the bump. The first change alone doesn't prevent this.

Notes

• verify-api.yml shares the pr-auto-commit concurrency group but isn't affected. Its committing job checks out head.sha without submodules and pushes from a detached HEAD, so its git add -A sees no gitlink changes.
• deps/* bump PRs aren't directly at risk. Across the last ~470 PRs, none got a bot format commit, because format-code only triggers on src/, test/ and samples/ changes. Their effect is indirect: each bump that lands on main is what turns a dragged pointer on some other PR into a conflict.
• I reproduced both failure modes in a throwaway repo (merge-ref checkout, and a branch that moves mid-run) and checked that each change behaves as described. CI only exercises the no-op path, since this PR has nothing to format.

#skip-changelog

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.23%. Comparing base (31350bd) to head (808b6c8).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5723      +/-   ##
==========================================
- Coverage   75.23%   75.23%   -0.01%     
==========================================
  Files         516      516              
  Lines       19022    19023       +1     
  Branches     3698     3698              
==========================================
  Hits        14312    14312              
- Misses       3855     3857       +2     
+ Partials      855      854       -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[ric-oliv]

LGTM