@@ -63,7 +63,10 @@ jobs:
       - name: Checkout ${{ github.event.repository.name }}
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          # Keep full ancestry for the PR base worktree, without downloading
+          # historical file contents (especially gh-pages). See ci/README.md.
           fetch-depth: 0
+          filter: blob:none
           persist-credentials: false
 
       - name: Setup pixi
 
@@ -38,7 +38,10 @@ jobs:
       - name: Checkout ${{ github.event.repository.name }}
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          # Full history and tags for package metadata, without historical
+          # file contents. See ci/README.md for the checkout policy.
           fetch-depth: 0
+          filter: blob:none
           ref: ${{ github.event.repository.default_branch }}
 
       - name: Setup pixi
 
@@ -84,6 +84,7 @@ jobs:
           # package version; a shallow checkout yields 0.1.dev1, which trips
           # cuda.core's "cuda.bindings 12.x or 13.x must be installed" guard.
           fetch-depth: 0
+          filter: blob:none
 
       - name: Setup pixi
         uses: ./.github/actions/setup-pixi
@@ -140,6 +141,7 @@ jobs:
           # package version; a shallow checkout yields 0.1.dev1, which trips
           # cuda.core's "cuda.bindings 12.x or 13.x must be installed" guard.
           fetch-depth: 0
+          filter: blob:none
 
       - name: Setup pixi
         uses: ./.github/actions/setup-pixi
@@ -205,6 +207,7 @@ jobs:
           # package version; a shallow checkout yields 0.1.dev1, which trips
           # cuda.core's "cuda.bindings 12.x or 13.x must be installed" guard.
           fetch-depth: 0
+          filter: blob:none
 
       - name: Setup proxy cache
         uses: nv-gha-runners/setup-proxy-cache@main
 
@@ -87,12 +87,11 @@ jobs:
       doc-only: ${{ steps.get-should-skip.outputs.doc_only }}
       base-ref: ${{ steps.get-should-skip.outputs.base_ref }}
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - name: Compute whether to skip builds and tests
         id: get-should-skip
         env:
           GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
         run: |
           set -euxo pipefail
           if ${{ startsWith(github.ref_name, 'pull-request/') }}; then
@@ -143,9 +142,8 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
-          # Treeless clone: the commit graph is needed to resolve the PR merge
-          # base and classify its changed paths, but historical blobs aren't.
-          fetch-depth: 0
+          # Only PR mirrors need full ancestry to find their merge base.
+          fetch-depth: ${{ startsWith(github.ref_name, 'pull-request/') && '0' || '1' }}
           filter: blob:none
 
       - name: Resolve PR merge base
 
@@ -36,9 +36,9 @@ jobs:
       - name: Checkout repository
         uses: actions/[email protected]
         with:
-          # Treeless clone: `git worktree add gh-pages` needs the commit graph,
-          # but historical blobs aren't required.
-          fetch-depth: 0
+          # The cleanup script fetches gh-pages explicitly; source history
+          # and unrelated branches aren't needed for the script checkout.
+          fetch-depth: 1
           filter: blob:none
 
       - name: Configure git identity
 
@@ -20,4 +20,4 @@ jobs:
       pull-requests: write
     steps:
       - name: Apply labels
-        uses: actions/labeler@e52e4fb63ed5cd0e07abaad9826b2a893ccb921f  # main (include actions/labeler#917)
+        uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13  # v7.0.0
@@ -62,9 +62,9 @@ jobs:
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
-          # lookup-run-id resolves the git tag to a SHA; we need tags but not history.
+          # The exact tag supplies the SHA for lookup-run-id; no other tags
+          # or commit history are needed.
           fetch-depth: 1
-          fetch-tags: true
           # Resolve only the exact tag ref; checkout fails if the tag does not exist.
           ref: refs/tags/${{ steps.vars.outputs.tag }}
 
 
@@ -19,12 +19,12 @@ repos:
   # Self-installing: the hook downloads a pinned, checksum-verified trufflehog on
   # first use (no manual install). Skipped on pre-commit.ci; Pulse CI enforces server-side.
   - repo: https://github.com/NVIDIA/security-workflows
-    rev: 711025b090f2aa728da576700750b195d1e816dc  # frozen: v0.3.0
+    rev: c736f0454dc99764a66af6b906adfcdfbf621985  # frozen: v0.4.0
     hooks:
       - id: secret-scan-trufflehog
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: c60c980e561ed3e73101667fe8365c609d19a438  # frozen: v0.15.9
+    rev: a56c0b927e6465d37cae3e97d35d4d18ab2b96cd  # frozen: v0.16.9
     hooks:
       - id: ruff-check
         args: [--fix, --show-fixes]
@@ -155,7 +155,7 @@ repos:
     - id: rst-inline-touching-normal
 
   - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: 8e5c80792e2ec0c87804d8ef915bf35e2caea6da  # frozen: v1.20.0
+    rev: 7ff8d35ae36a7d2b968f2f90b4c723e292e594ee  # frozen: v2.3.1
     hooks:
       - id: mypy
         alias: mypy-pathfinder
@@ -180,7 +180,7 @@ repos:
         exclude: ^\.github/workflows/coverage.yml$
 
   - repo: https://github.com/MarcoGorelli/cython-lint
-    rev: "7c6152f6c8f9087684ff2e09a9227941e233bafb"  # frozen: v0.19.0
+    rev: "eb2f695bb80387913b8cb1f91ba7ff6cb3026715"  # frozen: v0.21.1
     hooks:
       - id: cython-lint
         args: [--no-pycodestyle]
 
@@ -165,9 +165,9 @@ to miss in large files and makes later per-test provenance changes ambiguous.
   ```python
   import pytest
 
+
   @pytest.mark.agent_authored(model="gpt-5.5")
-  def test_something():
-      ...
+  def test_something(): ...
   ```
 
 - `@pytest.mark.human_reviewed`: a human has materially reviewed or rewritten
 
@@ -1,5 +1,30 @@
 # Continuous Integration
 
+## Checkout History
+
+Use the default shallow checkout for jobs that only read files or test prebuilt
+wheels. Source builds need complete commit ancestry and release tags so
+`setuptools-scm` can derive each package's version.
+
+For those jobs, use `fetch-depth: 0` with `filter: blob:none`. The checkout
+action fetches complete ancestry for all branches and tags, while the blob
+filter skips historical file contents. This avoids downloading the large
+historical `gh-pages` contents discussed in issue #2197. Git retrieves file
+contents as needed when checking out the requested commit or creating the
+freshness check's base-commit worktree.
+
+CI change detection uses this full-history checkout for PR mirrors, so the
+actual PR base branch is available when computing its merge base. Non-PR runs
+need only a shallow checkout. PR-preview cleanup checks out its script
+shallowly and fetches `gh-pages` separately when needed. Pathfinder release
+preparation fetches its exact tag without requesting every other tag.
+
+Git documents blob filtering in its
+[clone reference](https://git-scm.com/docs/git-clone#Documentation/git-clone.txt---filterltfilter-specgt).
+The pinned checkout action's
+[`README`](https://github.com/actions/checkout/blob/3d3c42e5aac5ba805825da76410c181273ba90b1/README.md#fetch-all-history-for-all-tags-and-branches)
+documents `fetch-depth: 0` for fetching all history, branches, and tags.
+
 ## Repository Customizations
 
 The workflows in this repository use the `CI_CUSTOMIZATIONS_*` namespace for