Semgrep "unable to clone" / diff-aware baseline failure in CI

By Daniel Zoghalchali·Latchkey

On pull requests, semgrep ci runs diff-aware, scanning only changed lines against a baseline. That requires access to the base commit. A shallow checkout or missing history stops it from finding the baseline.

What this error means

Semgrep fails with "unable to clone", "Could not find baseline commit", or a git error when computing the diff on a pull request.

Semgrep exited with an error: unable to clone: baseline commit not found.
Fetch the base branch so the diff can be computed.

Common causes

A shallow checkout lacks the base commit

The default fetch-depth: 1 checkout does not include the base branch, so diff-aware scanning cannot find the baseline.

The base ref was not fetched

The workflow did not fetch the target branch, so git cannot compute the changed set.

How to fix it

Check out full history

1. Set fetch-depth: 0 on actions/checkout so the base commit is present.
2. Run semgrep ci after the full checkout.
3. Confirm the diff-aware scan finds the baseline.

- uses: actions/checkout@v4
  with:
    fetch-depth: 0
- run: semgrep ci
  env:
    SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}

Fetch the base branch explicitly

If you cannot use full depth, fetch the base ref so the baseline commit exists locally.

- run: git fetch --no-tags --depth=50 origin ${{ github.base_ref }}

How to prevent it

• Use fetch-depth: 0 for diff-aware Semgrep on pull requests.
• Fetch the base branch before scanning if depth is limited.
• Run full scans on the default branch as a baseline.

Frequently asked questions

Related guides

References

• Git reference manual
• GitHub Actions documentation