diff --git a/.github/actions/cora-review-simple/action.yml b/.github/actions/cora-review-simple/action.yml
index 2de5175..c217dcb 100644
--- a/.github/actions/cora-review-simple/action.yml
+++ b/.github/actions/cora-review-simple/action.yml
@@ -93,8 +93,29 @@ runs:
           > cora-results.sarif 2>/dev/null
         echo "Cora review complete ($(wc -c < cora-results.sarif) bytes)"
 
-    - name: Upload SARIF to GitHub Code Scanning
+    - name: Check SARIF for findings
+      id: sarif-check
       if: inputs.upload-sarif == 'true'
+      shell: bash
+      run: |
+        RESULTS=$(python3 -c "
+        import json, sys
+        try:
+            data = json.load(open('cora-results.sarif'))
+            results = data.get('runs', [{}])[0].get('results', [])
+            print(len(results))
+        except:
+            print(0)
+        " 2>/dev/null || echo "0")
+        echo "results=$RESULTS" >> "$GITHUB_OUTPUT"
+        if [ "$RESULTS" -gt 0 ]; then
+          echo "SARIF contains $RESULTS finding(s) — will upload."
+        else
+          echo "SARIF has no findings — skipping upload."
+        fi
+
+    - name: Upload SARIF to GitHub Code Scanning
+      if: inputs.upload-sarif == 'true' && steps.sarif-check.outputs.results > 0
       continue-on-error: true
       uses: github/codeql-action/upload-sarif@v4
       with:
diff --git a/.github/actions/cora-review/action.yml b/.github/actions/cora-review/action.yml
index 87575de..30ac653 100644
--- a/.github/actions/cora-review/action.yml
+++ b/.github/actions/cora-review/action.yml
@@ -128,8 +128,29 @@ runs:
           exit 1
         fi
 
-    - name: Upload SARIF to GitHub Code Scanning
+    - name: Check SARIF for findings
+      id: sarif-check
       if: inputs.upload-sarif == 'true'
+      shell: bash
+      run: |
+        RESULTS=$(python3 -c "
+        import json, sys
+        try:
+            data = json.load(open('cora-results.sarif'))
+            results = data.get('runs', [{}])[0].get('results', [])
+            print(len(results))
+        except:
+            print(0)
+        " 2>/dev/null || echo "0")
+        echo "results=$RESULTS" >> "$GITHUB_OUTPUT"
+        if [ "$RESULTS" -gt 0 ]; then
+          echo "SARIF contains $RESULTS finding(s) — will upload."
+        else
+          echo "SARIF has no findings — skipping upload."
+        fi
+
+    - name: Upload SARIF to GitHub Code Scanning
+      if: inputs.upload-sarif == 'true' && steps.sarif-check.outputs.results > 0
       continue-on-error: true
       uses: github/codeql-action/upload-sarif@f52b05f4acaaa234e44466e66d29050e135ea9ef # v4.36.0
       with: