# SonarQube "Shallow clone detected" warning in CI

> Fix SonarQube "Shallow clone detected, no blame information will be provided" in CI - the default fetch-depth:1 checkout hides git history Sonar needs for new-code detection and blame.

Source: https://latchkey.dev/learn/ci-integrations/sonarqube-shallow-clone-detected-in-ci  
Updated: 2026-06-30

GitHub Actions checks out a shallow clone (fetch-depth 1) by default. Sonar needs full history to compute blame and identify new code, so it warns and may miss-assign issues or skew new-code coverage.

## Diagnose it: did the report reach the service?

Coverage and quality integrations fail in two distinct places: the report was never produced, or it was produced and the upload was rejected. Establish which before touching tokens.

```Terminal
# 1. does the report exist and is it non-empty?
ls -la coverage/ && head -5 coverage/lcov.info

# 2. does it reference paths the service can map to the repo?
grep "^SF:" coverage/lcov.info | head -5

# 3. did the upload actually succeed, or just not fail the step?
# most uploaders exit 0 on a rejected upload unless told otherwise
```

> Absolute paths in an lcov report break file mapping on the service side, so coverage appears as zero even though the upload succeeded. Generate reports with paths relative to the repository root.

## FAQ

### What causes SonarQube "Shallow clone detected" warning in CI?

There are 2 common causes: actions/checkout uses fetch-depth: 1 by default and new-code detection relies on history that is absent. The default shallow checkout fetches only the latest commit, so Sonar has no history for blame or new-code period detection.

### How do I fix SonarQube "Shallow clone detected" warning in CI?

There are 2 fixes depending on which cause you have: fetch full history before the scan and unshallow an existing shallow checkout. Work through them in order, since the first is the most common.

### What does SonarQube "Shallow clone detected" warning in CI actually mean?

The scan logs "Shallow clone detected, no blame information will be provided.

### How do I stop SonarQube "Shallow clone detected" warning in CI happening again?

Always set fetch-depth: 0 for jobs that run Sonar analysis. The prevention section lists 3 changes that keep it from recurring.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt