From 9aa8e99b0a81621dcb15e40de0a36ab4c143a569 Mon Sep 17 00:00:00 2001
From: CTO Hermes <cto-hermes@users.noreply.github.com>
Date: Wed, 3 Jun 2026 17:16:26 +0700
Subject: [PATCH] fix: skip SARIF upload when no findings (avoids CodeCora fail
 on clean PRs)

Only upload SARIF to GitHub Code Scanning when the review actually found
issues. This prevents the CodeCora check from showing as 'failed' on clean
PRs where cora found no problems.

The upload-sarif step now depends on a sarif-check step that parses the
SARIF and outputs the findings count. The upload only runs when
findings > 0.

Co-Authored-By: codecoradev <noreply@github.com>
---
 .github/actions/cora-review-simple/action.yml | 23 ++++++++++++++++++-
 .github/actions/cora-review/action.yml        | 23 ++++++++++++++++++-
 2 files changed, 44 insertions(+), 2 deletions(-)

diff --git a/.github/actions/cora-review-simple/action.yml b/.github/actions/cora-review-simple/action.yml
index 2de5175..c217dcb 100644
--- a/.github/actions/cora-review-simple/action.yml
+++ b/.github/actions/cora-review-simple/action.yml
@@ -93,8 +93,29 @@ runs:
           > cora-results.sarif 2>/dev/null
         echo "Cora review complete ($(wc -c < cora-results.sarif) bytes)"
 
-    - name: Upload SARIF to GitHub Code Scanning
+    - name: Check SARIF for findings
+      id: sarif-check
       if: inputs.upload-sarif == 'true'
+      shell: bash
+      run: |
+        RESULTS=$(python3 -c "
+        import json, sys
+        try:
+            data = json.load(open('cora-results.sarif'))
+            results = data.get('runs', [{}])[0].get('results', [])
+            print(len(results))
+        except:
+            print(0)
+        " 2>/dev/null || echo "0")
+        echo "results=$RESULTS" >> "$GITHUB_OUTPUT"
+        if [ "$RESULTS" -gt 0 ]; then
+          echo "SARIF contains $RESULTS finding(s) — will upload."
+        else
+          echo "SARIF has no findings — skipping upload."
+        fi
+
+    - name: Upload SARIF to GitHub Code Scanning
+      if: inputs.upload-sarif == 'true' && steps.sarif-check.outputs.results > 0
       continue-on-error: true
       uses: github/codeql-action/upload-sarif@v4
       with:
diff --git a/.github/actions/cora-review/action.yml b/.github/actions/cora-review/action.yml
index 87575de..30ac653 100644
--- a/.github/actions/cora-review/action.yml
+++ b/.github/actions/cora-review/action.yml
@@ -128,8 +128,29 @@ runs:
           exit 1
         fi
 
-    - name: Upload SARIF to GitHub Code Scanning
+    - name: Check SARIF for findings
+      id: sarif-check
       if: inputs.upload-sarif == 'true'
+      shell: bash
+      run: |
+        RESULTS=$(python3 -c "
+        import json, sys
+        try:
+            data = json.load(open('cora-results.sarif'))
+            results = data.get('runs', [{}])[0].get('results', [])
+            print(len(results))
+        except:
+            print(0)
+        " 2>/dev/null || echo "0")
+        echo "results=$RESULTS" >> "$GITHUB_OUTPUT"
+        if [ "$RESULTS" -gt 0 ]; then
+          echo "SARIF contains $RESULTS finding(s) — will upload."
+        else
+          echo "SARIF has no findings — skipping upload."
+        fi
+
+    - name: Upload SARIF to GitHub Code Scanning
+      if: inputs.upload-sarif == 'true' && steps.sarif-check.outputs.results > 0
       continue-on-error: true
       uses: github/codeql-action/upload-sarif@f52b05f4acaaa234e44466e66d29050e135ea9ef # v4.36.0
       with: