TruffleHog "unable to clone repo" from a shallow checkout in CI

By Kaveh Alemi·Latchkey

The TruffleHog GitHub Action scans the range between BASE and HEAD. On a default shallow checkout the base commit is missing, so the clone or diff fails and no history is scanned.

What this error means

TruffleHog logs "unable to clone repo" or "BASE and HEAD are the same commit, nothing to scan" and either errors or passes without scanning any history.

Error: unable to clone repo: object not found
::error::BASE and HEAD commits are the same. TruffleHog won't scan anything.
Please see https://github.com/trufflesecurity/trufflehog#shallow-cloning

Common causes

Shallow checkout is missing the base commit

With fetch-depth: 1 the base ref is not on the runner, so TruffleHog cannot resolve the diff range and the clone lookup fails.

BASE and HEAD resolve to the same commit

On a push of a single commit or a misconfigured trigger, base equals head, so the scan range is empty.

How to fix it

Fetch full history and set base/head

1. Set fetch-depth: 0 on checkout so both base and head exist.
2. Pass explicit base and head refs for PR scans.
3. Re-run so TruffleHog has a real commit range.

- uses: actions/checkout@v4
  with:
    fetch-depth: 0
- uses: trufflesecurity/trufflehog@main
  with:
    base: ${{ github.event.repository.default_branch }}
    head: HEAD

Scan the filesystem when history is unavailable

If a full clone is impractical, scan the working tree directly instead of a git range.

trufflehog filesystem . --only-verified --fail

How to prevent it

• Use fetch-depth: 0 for TruffleHog git-range scans.
• Set explicit base and head on pull_request triggers.
• Fall back to filesystem mode when only the tip is available.

Frequently asked questions

Related guides

References

• Git reference manual
• GitHub Actions documentation