[davidnmbond]

Problem

CodeQL has failed on every run for at least a week — 8 consecutive failures including the scheduled Monday scan. No security analysis has actually been running on this repository. The persistent red Analyze check is also why the stale Dependabot PRs looked unmergeable and sat untouched for two months.

Cause

actions/checkout defaults to a shallow clone. Nerdbank.GitVersioning walks commit history to compute the version height and throws when those objects are missing:

Nerdbank.GitVersioning.GitException: Shallow clone lacks the objects
required to calculate version height.
  ---> An commit object with SHA 74b2be5... could not be found.

autobuild died on that before CodeQL could extract any code, surfacing only the generic Error: Could not auto-detect a suitable build method.

ci.yml already sets fetch-depth: 0 for exactly this reason. codeql.yml was simply missing it.

Verification

Reproduced both sides locally against this repo:

Clone	Result
git clone --depth 1	identical GitException to the CI log
git clone (full)	Build succeeded.

The Analyze check on this PR is the real confirmation — it should go green for the first time in weeks.

🤖 Generated with Claude Code

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

AI Reviewer: run a review on demand. To trigger the first review automatically, go to your organization or repository integration settings. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.