GitHub Actions checks out a shallow clone (fetch-depth 1) by default. Sonar needs full history to compute blame and identify new code, so it warns and may miss-assign issues or skew new-code coverage.
What this error means
The scan logs "Shallow clone detected, no blame information will be provided. You can convert to non-shallow with 'git fetch --unshallow'." and new-code metrics look wrong.
SonarQube
WARN: Shallow clone detected, no blame information will be provided. You can convert
to non-shallow with 'git fetch --unshallow'.
Diagnose it: did the report reach the service?
Coverage and quality integrations fail in two distinct places: the report was never produced, or it was produced and the upload was rejected. Establish which before touching tokens.
Terminal
# 1. does the report exist and is it non-empty?
ls -la coverage/ && head -5 coverage/lcov.info
# 2. does it reference paths the service can map to the repo?
grep "^SF:" coverage/lcov.info | head -5
# 3. did the upload actually succeed, or just not fail the step?# most uploaders exit 0 on a rejected upload unless told otherwise
Common causes
actions/checkout uses fetch-depth: 1 by default
The default shallow checkout fetches only the latest commit, so Sonar has no history for blame or new-code period detection.
New-code detection relies on history that is absent
Without full history, Sonar cannot reliably determine which lines are new, affecting Quality Gate conditions scoped to new code.
How to fix it
Fetch full history before the scan
Set fetch-depth: 0 on the checkout so Sonar gets complete history.
Run the scan after checkout.
Confirm the shallow-clone warning is gone.
.github/workflows/ci.yml
- uses:actions/checkout@v4with:fetch-depth:0
Unshallow an existing shallow checkout
If you cannot change the checkout step, convert to a full clone before scanning.
Terminal
git fetch --unshallow
How to prevent it
Always set fetch-depth: 0 for jobs that run Sonar analysis.
Keep the scan step after the full checkout.
Treat the shallow-clone warning as an error when new-code metrics matter.
Frequently asked questions
What causes SonarQube "Shallow clone detected" warning in CI?
There are 2 common causes: actions/checkout uses fetch-depth: 1 by default and new-code detection relies on history that is absent. The default shallow checkout fetches only the latest commit, so Sonar has no history for blame or new-code period detection.
How do I fix SonarQube "Shallow clone detected" warning in CI?
There are 2 fixes depending on which cause you have: fetch full history before the scan and unshallow an existing shallow checkout. Work through them in order, since the first is the most common.
What does SonarQube "Shallow clone detected" warning in CI actually mean?
The scan logs "Shallow clone detected, no blame information will be provided.
How do I stop SonarQube "Shallow clone detected" warning in CI happening again?
Always set fetch-depth: 0 for jobs that run Sonar analysis. The prevention section lists 3 changes that keep it from recurring.
