False Negative with https://github.com/robmoffat/codeql-vuln-blog

**Description of the issue**

I forked the repo: https://github.com/robmoffat/codeql-vuln-blog

and then added the CodeQL GH action, but no vulnerabilities are reported.

Reviewing the python code in the repo, it seems ripe with SQL injection possibilities.

What am I doing wrong?

thanks