diff --git a/scripts/generate-report.py b/scripts/generate-report.py
index b9a47a4..c2a4ee5 100755
--- a/scripts/generate-report.py
+++ b/scripts/generate-report.py
@@ -186,7 +186,12 @@ def main() -> int:
     parser = argparse.ArgumentParser(description=__doc__,
                                      formatter_class=argparse.RawDescriptionHelpFormatter)
     parser.add_argument("--sarif", required=True, type=Path)
-    parser.add_argument("--pr-number", type=int, help="omit to skip commenting")
+    # Deliberately a string, not an int. On a workflow_dispatch or push run there
+    # is no pull request, so the workflow interpolates an empty value here and an
+    # int converter would abort the whole step. An absent PR is a normal state:
+    # write the summary, skip the comment.
+    parser.add_argument("--pr-number", default="",
+                        help="pull request number; empty or omitted skips commenting")
     parser.add_argument("--repo", help="owner/name")
     parser.add_argument("--coverage", type=Path, default=Path("coverage-report.json"),
                         help="optional coverage report to fold into the comment")
@@ -213,11 +218,21 @@ def main() -> int:
         with open(step_summary, "a", encoding="utf-8") as handle:
             handle.write(body + "\n")
 
+    pr_number = str(args.pr_number).strip()
+    if pr_number and not pr_number.isdigit():
+        print(f"warning: --pr-number {pr_number!r} is not a number — skipping the comment",
+              file=sys.stderr)
+        pr_number = ""
+
     token = os.environ.get("GITHUB_TOKEN")
-    if args.pr_number and args.repo and token:
-        upsert_comment(args.repo, args.pr_number, body, token)
-    elif args.pr_number and not token:
+    if not pr_number:
+        print("no pull request in context — summary written, comment skipped")
+    elif not args.repo:
+        print("note: --repo not given — skipping the PR comment", file=sys.stderr)
+    elif not token:
         print("note: GITHUB_TOKEN is not set — skipping the PR comment", file=sys.stderr)
+    else:
+        upsert_comment(args.repo, pr_number, body, token)
 
     # Reporting never fails the build; the scan step owns the pass/fail decision.
     return 0