SonarQube "Shallow clone detected" warning in CI

By Daniel Zoghalchali·Latchkey

GitHub Actions checks out a shallow clone (fetch-depth 1) by default. Sonar needs full history to compute blame and identify new code, so it warns and may miss-assign issues or skew new-code coverage.

What this error means

The scan logs "Shallow clone detected, no blame information will be provided. You can convert to non-shallow with 'git fetch --unshallow'." and new-code metrics look wrong.

WARN: Shallow clone detected, no blame information will be provided. You can convert
to non-shallow with 'git fetch --unshallow'.

Common causes

actions/checkout uses fetch-depth: 1 by default

The default shallow checkout fetches only the latest commit, so Sonar has no history for blame or new-code period detection.

New-code detection relies on history that is absent

Without full history, Sonar cannot reliably determine which lines are new, affecting Quality Gate conditions scoped to new code.

How to fix it

Fetch full history before the scan

1. Set fetch-depth: 0 on the checkout so Sonar gets complete history.
2. Run the scan after checkout.
3. Confirm the shallow-clone warning is gone.

- uses: actions/checkout@v4
  with:
    fetch-depth: 0

Unshallow an existing shallow checkout

If you cannot change the checkout step, convert to a full clone before scanning.

git fetch --unshallow

How to prevent it

• Always set fetch-depth: 0 for jobs that run Sonar analysis.
• Keep the scan step after the full checkout.
• Treat the shallow-clone warning as an error when new-code metrics matter.

Frequently asked questions

Related guides

References

• Git reference manual
• GitHub Actions documentation