@@ -171,9 +171,7 @@ jobs:
       - name: Checkout Source
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
-          fetch-depth: 1
           ref: ${{ inputs.git-tag }}
-          persist-credentials: false
 
       - name: Set up Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
 
@@ -5,12 +5,9 @@
 
 Usage:
     python check_release_notes.py --git-tag <tag> --component <component>
-    python check_release_notes.py --git-tag <tag> --component <component> --git-ref refs/tags/<tag>
 
-By default, notes and release configuration come from the working tree.
---git-ref reads those files from the given ref without changing the checkout,
-so the workflow's current checker can validate older release tags. Successful
-checks append the parsed version to GITHUB_OUTPUT when it is set.
+Notes and release configuration come from the working tree. Successful checks
+append the parsed version to GITHUB_OUTPUT when it is set.
 
 Exit codes:
     0 — release-notes policy satisfied
@@ -23,7 +20,6 @@
 import argparse
 import os
 import re
-import subprocess
 import sys
 from pathlib import Path
 
@@ -70,41 +66,16 @@ def is_post_release(version: str) -> bool:
     return ".post" in version
 
 
-def read_repo_file(path: Path, repo_root: Path, git_ref: str | None = None) -> bytes | None:
-    """Read a file from the working tree or an already-resolved Git commit."""
-    if git_ref is None:
-        full = repo_root / path
-        return full.read_bytes() if full.is_file() else None
-
-    object_name = f"{git_ref}:{path.as_posix()}"
-    result = subprocess.run(
-        ["git", "cat-file", "--batch-check=%(objecttype)"],  # noqa: S607
-        input=f"{object_name}\n",
-        cwd=repo_root,
-        check=True,
-        capture_output=True,
-        text=True,
-    )
-    object_type = result.stdout.strip()
-    if object_type == f"{object_name} missing" or object_type == "tree":
-        return None
-    if object_type != "blob":
-        raise ValueError(f"Cannot read release-notes source {object_name!r}: unexpected object type {object_type!r}")
-    return subprocess.run(  # noqa: S603 - the resolved commit and path are passed without a shell.
-        ["git", "show", object_name],  # noqa: S607
-        cwd=repo_root,
-        check=True,
-        capture_output=True,
-    ).stdout
-
-
-def load_backport_branch(repo_root: Path = Path("."), git_ref: str | None = None) -> str | None:
-    contents = read_repo_file(Path("ci", "versions.yml"), repo_root, git_ref)
-    if contents is not None:
-        for line in contents.decode("utf-8").splitlines():
-            m = BACKPORT_BRANCH_RE.match(line.strip())
-            if m:
-                return m.group("branch")
+def load_backport_branch(repo_root: Path = Path(".")) -> str | None:
+    path = repo_root / "ci" / "versions.yml"
+    try:
+        with open(path, encoding="utf-8") as f:
+            for line in f:
+                m = BACKPORT_BRANCH_RE.match(line.strip())
+                if m:
+                    return m.group("branch")
+    except FileNotFoundError:
+        pass
     github_ref_name = os.environ.get("GITHUB_REF_NAME", "")
     if BACKPORT_BRANCH_NAME_RE.match(github_ref_name):
         return github_ref_name
@@ -121,9 +92,7 @@ def notes_path(package: str, version: str) -> Path:
     return Path(package, "docs", "source", "release", f"{version}-notes.rst")
 
 
-def check_release_notes(
-    git_tag: str, component: str, repo_root: Path = Path("."), git_ref: str | None = None
-) -> list[tuple[str | Path, str]]:
+def check_release_notes(git_tag: str, component: str, repo_root: Path = Path(".")) -> list[tuple[str | Path, str]]:
     """Return a list of (path, reason) for missing or empty release notes.
 
     ``path`` is the repo-relative notes path, or a ``<placeholder>`` naming the
@@ -143,10 +112,10 @@ def check_release_notes(
         return []
 
     path = notes_path(COMPONENT_TO_PACKAGE[component], version)
-    contents = read_repo_file(path, repo_root, git_ref)
-    if contents is None:
+    full = repo_root / path
+    if not full.is_file():
         return [(path, "missing")]
-    if not contents and component != "cuda-pathfinder":
+    if full.stat().st_size == 0 and component != "cuda-pathfinder":
         return [(path, "empty")]
     return []
 
@@ -193,7 +162,6 @@ def validate_backport_decision(
     backport_git_tag: str,
     backport_branch: str | None,
     repo_root: Path,
-    git_ref: str | None = None,
 ) -> tuple[int | None, list[tuple[str | Path, str]]]:
     if component not in BACKPORT_PLANNING_COMPONENTS or is_post_release(version):
         return None, []
@@ -203,7 +171,7 @@ def validate_backport_decision(
         return 2, []
 
     if is_backport_version(version, backport_branch):
-        problems = check_release_notes(git_tag, component, repo_root, git_ref)
+        problems = check_release_notes(git_tag, component, repo_root)
         if problems:
             warn_missing_backport_notes(git_tag, component, problems)
         else:
@@ -241,7 +209,7 @@ def validate_backport_decision(
         )
         return 2, []
 
-    problems = check_release_notes(decision, component, repo_root, git_ref)
+    problems = check_release_notes(decision, component, repo_root)
     if problems:
         return 1, problems
     return None, []
@@ -252,9 +220,6 @@ def main(argv: list[str] | None = None) -> int:
     parser.add_argument("--git-tag", required=True)
     parser.add_argument("--component", required=True, choices=list(COMPONENT_TO_PACKAGE))
     parser.add_argument("--repo-root", default=Path("."), type=Path)
-    parser.add_argument(
-        "--git-ref", help="Read notes and release configuration from this Git ref without checking it out"
-    )
     parser.add_argument("--backport-git-tag", default="")
     parser.add_argument("--backport-branch", default="")
     args = parser.parse_args(argv)
@@ -267,41 +232,19 @@ def main(argv: list[str] | None = None) -> int:
         )
         return 2
 
-    source_ref = args.git_ref
-    try:
-        if args.git_ref is not None:
-            args.git_ref = subprocess.run(  # noqa: S603 - --end-of-options prevents the ref from becoming an option.
-                ["git", "rev-parse", "--verify", "--end-of-options", f"{args.git_ref}^{{commit}}"],  # noqa: S607
-                cwd=args.repo_root,
-                check=True,
-                capture_output=True,
-                text=True,
-            ).stdout.strip()
-        return check_policy(args, version)
-    except subprocess.CalledProcessError as exc:
-        detail = exc.stderr.decode("utf-8") if isinstance(exc.stderr, bytes) else exc.stderr
-        print(f"ERROR: cannot read Git release-notes source {source_ref!r}: {detail.strip()}", file=sys.stderr)
-        return 2
-    except ValueError as exc:
-        print(f"ERROR: {exc}", file=sys.stderr)
-        return 2
-
-
-def check_policy(args: argparse.Namespace, version: str) -> int:
     if is_post_release(version) and args.component != "cuda-pathfinder":
         print(f"Post-release tag ({args.git_tag}), skipping release-notes check.")
         write_version_output(version)
         return 0
 
-    backport_branch = args.backport_branch or load_backport_branch(args.repo_root, args.git_ref)
+    backport_branch = args.backport_branch or load_backport_branch(args.repo_root)
     rc, problems = validate_backport_decision(
         git_tag=args.git_tag,
         component=args.component,
         version=version,
         backport_git_tag=args.backport_git_tag,
         backport_branch=backport_branch,
         repo_root=args.repo_root,
-        git_ref=args.git_ref,
     )
     if rc is not None:
         if problems:
@@ -313,7 +256,7 @@ def check_policy(args: argparse.Namespace, version: str) -> int:
         return rc
 
     if not problems:
-        problems = check_release_notes(args.git_tag, args.component, args.repo_root, args.git_ref)
+        problems = check_release_notes(args.git_tag, args.component, args.repo_root)
 
     if not problems:
         print(f"Release notes present for tag {args.git_tag}, component {args.component}.")
 
@@ -3,7 +3,6 @@
 
 from __future__ import annotations
 
-import subprocess
 import sys
 from pathlib import Path
 
@@ -19,35 +18,6 @@
 )
 
 
-@pytest.fixture
-def git_source(tmp_path, monkeypatch):
-    """Model read-only Git commands without creating commits in test fixtures."""
-    files = {}
-    calls = []
-    commit = "1" * 40
-
-    def run(command, **kwargs):
-        assert kwargs["cwd"] == tmp_path
-        assert kwargs["check"] is True
-        calls.append(command)
-        if command[1] == "rev-parse":
-            return subprocess.CompletedProcess(command, 0, stdout=f"{commit}\n", stderr="")
-        if command[1] == "cat-file":
-            object_name = kwargs["input"].strip()
-            ref, path = object_name.split(":", 1)
-            assert ref == commit
-            stdout = "blob\n" if path in files else f"{object_name} missing\n"
-            return subprocess.CompletedProcess(command, 0, stdout=stdout, stderr="")
-        if command[1] == "show":
-            ref, path = command[2].split(":", 1)
-            assert ref == commit
-            return subprocess.CompletedProcess(command, 0, stdout=files[path], stderr=b"")
-        pytest.fail(f"Unexpected Git command: {command}")
-
-    monkeypatch.setattr("check_release_notes.subprocess.run", run)
-    return files, calls
-
-
 class TestParseVersionFromTag:
     def test_plain_tag_bindings(self):
         assert parse_version_from_tag("v13.1.0", "cuda-bindings") == "13.1.0"
@@ -430,142 +400,3 @@ def test_invalid_pathfinder_tags_do_not_expose_version(tmp_path, monkeypatch, ta
 
     assert main(["--git-tag", tag, "--component", "cuda-pathfinder", "--repo-root", str(tmp_path)]) == 2
     assert not output.exists()
-
-
-@pytest.mark.parametrize("contents,expected", [(b"", 0), (b"Release notes.", 0), (None, 1)])
-@pytest.mark.agent_authored(model="gpt-6.1")
-def test_git_ref_reads_pathfinder_post_notes_instead_of_worktree(tmp_path, monkeypatch, git_source, contents, expected):
-    files, calls = git_source
-    path = "cuda_pathfinder/docs/source/release/1.5.2.post1-notes.rst"
-    worktree_notes = tmp_path / path
-    worktree_notes.parent.mkdir(parents=True)
-    worktree_notes.write_text("Working tree notes must not decide the tagged release policy.")
-    if contents is not None:
-        files[path] = contents
-    output = tmp_path / "output"
-    monkeypatch.setenv("GITHUB_OUTPUT", str(output))
-
-    assert (
-        main(
-            [
-                "--git-tag",
-                "cuda-pathfinder-v1.5.2.post1",
-                "--component",
-                "cuda-pathfinder",
-                "--repo-root",
-                str(tmp_path),
-                "--git-ref",
-                "refs/tags/cuda-pathfinder-v1.5.2.post1",
-            ]
-        )
-        == expected
-    )
-    assert calls[0] == [
-        "git",
-        "rev-parse",
-        "--verify",
-        "--end-of-options",
-        "refs/tags/cuda-pathfinder-v1.5.2.post1^{commit}",
-    ]
-    assert worktree_notes.read_text() == "Working tree notes must not decide the tagged release policy."
-    assert output.exists() == (expected == 0)
-
-
-@pytest.mark.parametrize("component", ["cuda-bindings", "cuda-python"])
-@pytest.mark.parametrize("backport_present,expected", [(True, 0), (False, 1)])
-@pytest.mark.agent_authored(model="gpt-6.1")
-def test_git_ref_reads_release_backport_configuration_and_both_notes(
-    tmp_path, monkeypatch, git_source, component, backport_present, expected
-):
-    files, _ = git_source
-    files["ci/versions.yml"] = b'backport_branch: "12.9.x"\n'
-    package = component.replace("-", "_")
-    files[f"{package}/docs/source/release/13.3.0-notes.rst"] = b"Mainline notes."
-    if backport_present:
-        files[f"{package}/docs/source/release/12.9.7-notes.rst"] = b"Backport notes."
-    (tmp_path / "ci").mkdir()
-    (tmp_path / "ci" / "versions.yml").write_text('backport_branch: "12.8.x"\n')
-    output = tmp_path / "output"
-    monkeypatch.setenv("GITHUB_OUTPUT", str(output))
-
-    assert (
-        main(
-            [
-                "--git-tag",
-                "v13.3.0",
-                "--component",
-                component,
-                "--repo-root",
-                str(tmp_path),
-                "--git-ref",
-                "refs/tags/v13.3.0",
-                "--backport-git-tag",
-                "v12.9.7",
-            ]
-        )
-        == expected
-    )
-    assert output.exists() == (expected == 0)
-
-
-@pytest.mark.agent_authored(model="gpt-6.1")
-def test_missing_git_ref_is_an_error_not_missing_notes(tmp_path, monkeypatch, capsys):
-    def run(command, **kwargs):
-        assert command[1] == "rev-parse"
-        raise subprocess.CalledProcessError(128, command, stderr="fatal: Needed a single revision\n")
-
-    monkeypatch.setattr("check_release_notes.subprocess.run", run)
-    output = tmp_path / "output"
-    monkeypatch.setenv("GITHUB_OUTPUT", str(output))
-
-    assert (
-        main(
-            [
-                "--git-tag",
-                "cuda-pathfinder-v1.5.2",
-                "--component",
-                "cuda-pathfinder",
-                "--repo-root",
-                str(tmp_path),
-                "--git-ref",
-                "refs/tags/missing",
-            ]
-        )
-        == 2
-    )
-    assert "cannot read Git release-notes source" in capsys.readouterr().err
-    assert not output.exists()
-
-
-@pytest.mark.agent_authored(model="gpt-6.1")
-def test_git_read_failure_is_not_treated_as_missing_notes(tmp_path, monkeypatch, git_source, capsys):
-    files, _ = git_source
-    files["cuda_pathfinder/docs/source/release/1.5.2-notes.rst"] = b"Release notes."
-    run = subprocess.run
-
-    def failing_show(command, **kwargs):
-        if command[1] == "show":
-            raise subprocess.CalledProcessError(128, command, stderr=b"fatal: cannot read blob\n")
-        return run(command, **kwargs)
-
-    monkeypatch.setattr("check_release_notes.subprocess.run", failing_show)
-    output = tmp_path / "output"
-    monkeypatch.setenv("GITHUB_OUTPUT", str(output))
-
-    assert (
-        main(
-            [
-                "--git-tag",
-                "cuda-pathfinder-v1.5.2",
-                "--component",
-                "cuda-pathfinder",
-                "--repo-root",
-                str(tmp_path),
-                "--git-ref",
-                "refs/tags/cuda-pathfinder-v1.5.2",
-            ]
-        )
-        == 2
-    )
-    assert "cannot read blob" in capsys.readouterr().err
-    assert not output.exists()