fix: skip SARIF upload when no findings

[ajianaz]

Summary

CodeCora check shows ❌ fail on clean PRs because SARIF is always uploaded to GitHub Code Scanning — even when cora found zero issues.

Fix

Add a sarif-check step before upload that parses SARIF and counts findings. The upload-sarif step now only runs when findings > 0:

- name: Check SARIF for findings
  id: sarif-check
  run: |
    RESULTS=$(python3 -c "parse sarif, count results")
    echo "results=$RESULTS" >> "$GITHUB_OUTPUT"

- name: Upload SARIF to GitHub Code Scanning
  if: inputs.upload-sarif == 'true' && steps.sarif-check.outputs.results > 0
  uses: github/codeql-action/upload-sarif@v4

Behavior Change

Scenario	Before	After
PR with issues	SARIF uploaded ✅, CodeCora ❌ (expected)	SARIF uploaded ✅, CodeCora ❌ (expected)
Clean PR (no issues)	SARIF uploaded ✅, CodeCora ❌ (false fail)	SARIF skipped, no CodeCora check
LLM API failure	SARIF empty, CodeCora ❌ (false fail)	SARIF skipped, no CodeCora check

Files Modified

• .github/actions/cora-review/action.yml — add sarif-check + conditional upload
• .github/actions/cora-review-simple/action.yml — same fix

Co-Authored-By: codecoradev noreply@github.com

[github-actions]

🔍 Cora AI Code Review

❌ Blocked — critical issues found.

🔴 Error (2)

• .github/actions/cora-review-simple/action.yml:112 — The condition steps.sarif-check.outputs.results > 0 in GitHub Actions if expressions performs a string comparison, not a numeric one. While GitHub Actions does some type coercion, this is unreliable. For example, '9' > 0 is true but '10' > 0 may behave unexpectedly in string comparison contexts. The condition should explicitly use numeric comparison.
• .github/actions/cora-review/action.yml:147 — The condition steps.sarif-check.outputs.results > 0 in GitHub Actions if expressions performs a string comparison, not a numeric one. While GitHub Actions does some type coercion, this is unreliable. For example, '9' > 0 is true but '10' > 0 may behave unexpectedly in string comparison contexts. The condition should explicitly use numeric comparison.

---

Review powered by cora-cli · BYOK · MIT