From aedda4f88ba2a09ec0a7252ff4fce4b1d575ca0b Mon Sep 17 00:00:00 2001 From: David Bond Date: Thu, 3 Sep 2026 16:08:00 +0100 Subject: [PATCH] fix(ci): use a full clone for CodeQL so autobuild can determine the version Every CodeQL run has failed for at least a week, including the scheduled weekly scan, so no security analysis has actually been running. actions/checkout defaults to a shallow clone, but Nerdbank.GitVersioning walks commit history to compute the version height and throws outright when the objects are absent: GitException: Shallow clone lacks the objects required to calculate version height. autobuild died on that before CodeQL could extract anything, reporting only "Could not auto-detect a suitable build method". ci.yml already sets fetch-depth: 0 for this reason; codeql.yml was missing it. Verified locally: a --depth 1 clone reproduces the exact CI error, a full clone builds. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/codeql.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index fa4544f..3457804 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -18,6 +18,10 @@ jobs: security-events: write steps: - uses: actions/checkout@v7 + with: + # Nerdbank.GitVersioning walks history to compute the version height, so autobuild + # fails outright on the default shallow clone. CI does the same for the same reason. + fetch-depth: 0 - uses: github/codeql-action/init@v4 with: languages: csharp