You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Give CodeQL a full clone so Nerdbank.GitVersioning can version the build - #1
The CodeQL Analyze (csharp) job fails on main and on pull requests. actions/checkout defaults to a shallow clone (fetch-depth: 1), so Nerdbank.GitVersioning cannot compute the version height and autobuild stops with:
Shallow clone lacks the objects required to calculate version height
Fix
Set fetch-depth: 0 on the checkout step of the CodeQL workflow so the job gets full history. This is the same one-line change proven on panoramicdata/HubSpot.Api#8.
…rsion the build
CodeQL's autobuild failed on every run because the default shallow checkout
lacks the history Nerdbank.GitVersioning needs to compute the version height.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
This PR updates the CodeQL workflow to perform a full git clone by setting fetch-depth: 0. This allows Nerdbank.GitVersioning to access the full git history needed to calculate the project's version height, resolving potential build failures in the C# analysis job. Codacy analysis indicates the changes are up to standards with no new issues identified.
Test suggestions
Verify that the CodeQL 'Autobuild' step successfully computes the project version using Nerdbank.GitVersioning.
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify that the CodeQL 'Autobuild' step successfully computes the project version using Nerdbank.GitVersioning.
main failed with about 2,800 errors once 91f6bac turned TreatWarningsAsErrors back on. Fixed
without switching it off:
- Nullable reference types: the vendored projects use <Nullable>annotations</Nullable> (the
library and tests already carry some `?` annotations, so `disable` would give CS8632) and the
samples use disable. The library's nullability metadata is unchanged from 10.1.9.
- CA1416: System.Drawing-dependent public APIs are marked [SupportedOSPlatform("windows")]
(AutoFitColumns/AutoFit, AddPicture(Image|FileInfo), ExcelPicture.Image/ImageFormat,
SetFromFont, header/footer InsertPicture, background image, VML picture Image). Paths reachable
from platform-neutral code are guarded: loading or cross-package copying a System.Drawing
picture throws PlatformNotSupportedException off Windows, where it already failed.
- CA2022: unchecked Stream.Read calls use ReadAtLeast(..., throwOnEndOfStream: false), which
handles short reads and keeps the old no-throw behaviour at end of stream.
- WinZipAes moves from RijndaelManaged to Aes and from the Rfc2898DeriveBytes ctor to
Rfc2898DeriveBytes.Pbkdf2 (SHA1, same iterations, output split the same way); both verified
byte-identical. VBA signature certificates use X509CertificateLoader. Uri.EscapeUriString is
replaced by a local helper with identical output, verified on 28,000+ inputs.
- CA2200/CS0168 rethrow, CS8981 alias, CS8794 always-true pattern (behaviour kept), bad XML doc
params/crefs.
- CS1591 suppressed for the library only (2,211 undocumented vendored members); test and sample
projects no longer generate documentation files.
- Re-applies three fixes from 070eab9 that 91f6bac reverted: no MIT licence expression on the
LGPL package (NU5033), no Microsoft.Testing.Platform runner in global.json, and SampleWebApp
(now on WebApplication hosting, so no obsolete APIs). SampleApp moves to Microsoft.Data.SqlClient.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Only show the developer exception page in Development in SampleWebApp, and mark WinZip AES's
ECB use as intended: it is the block primitive for CTR mode, with HMAC-SHA1 for integrity.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Cause
The CodeQL
Analyze (csharp)job fails onmainand on pull requests.actions/checkoutdefaults to a shallow clone (fetch-depth: 1), so Nerdbank.GitVersioning cannot compute the version height and autobuild stops with:Fix
Set
fetch-depth: 0on the checkout step of the CodeQL workflow so the job gets full history. This is the same one-line change proven on panoramicdata/HubSpot.Api#8.Tracked under OPS-157454.
🤖 Generated with Claude Code