diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 81262f1e9f..cd7e26f3cf 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -1,9 +1,9 @@
 name: Test
 
 on:
-  pull_request: {}
+  pull_request: { }
   push:
-    branches: [main, develop]
+    branches: [ main, develop ]
 
 # Enrich gradle.properties for CI/CD
 env:
@@ -48,12 +48,12 @@ jobs:
           emulator-options: -no-snapshot-save -no-window -gpu swiftshader_indirect -noaudio -no-boot-anim -camera-back none
           disable-animations: true
           emulator-build: 7425822
-          script: | 
+          script: |
             ./gradlew gatherGplayDebugStringTemplates $CI_GRADLE_ARG_PROPERTIES
             ./gradlew unitTestsWithCoverage $CI_GRADLE_ARG_PROPERTIES
             ./gradlew instrumentationTestsWithCoverage $CI_GRADLE_ARG_PROPERTIES
             ./gradlew generateCoverageReport $CI_GRADLE_ARG_PROPERTIES
-# NB: continue-on-error marks steps.tests.conclusion = 'success' but leaves stes.tests.outcome = 'failure'
+      # NB: continue-on-error marks steps.tests.conclusion = 'success' but leaves stes.tests.outcome = 'failure'
       - name: Run all the codecoverage tests at once (retry if emulator failed)
         uses: reactivecircus/android-emulator-runner@v2
         if: always() && steps.tests.outcome == 'failure' # don't run if previous step succeeded.
@@ -70,12 +70,15 @@ jobs:
             ./gradlew unitTestsWithCoverage $CI_GRADLE_ARG_PROPERTIES
             ./gradlew instrumentationTestsWithCoverage $CI_GRADLE_ARG_PROPERTIES
             ./gradlew generateCoverageReport $CI_GRADLE_ARG_PROPERTIES
-      - run: ./gradlew sonarqube $CI_GRADLE_ARG_PROPERTIES
-        if: always() # we may have failed a previous step and retried, that's OK
+
+      # we may have failed a previous step and retried, that's OK
+      - name: Publish results to Sonar
         env:
           GITHUB_TOKEN: ${{ secrets.SONARQUBE_GITHUB_API_TOKEN }}  # Needed to get PR information, if any
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
           ORG_GRADLE_PROJECT_SONAR_LOGIN: ${{ secrets.SONAR_TOKEN }}
+        if: ${{ always() && env.GITHUB_TOKEN != '' && env.SONAR_TOKEN != '' && env.ORG_GRADLE_PROJECT_SONAR_LOGIN != '' }}
+        run: ./gradlew sonarqube $CI_GRADLE_ARG_PROPERTIES
 
       - name: Format unit test results
         if: always()
diff --git a/changelog.d/7057.misc b/changelog.d/7057.misc
new file mode 100644
index 0000000000..ded1229319
--- /dev/null
+++ b/changelog.d/7057.misc
@@ -0,0 +1 @@
+CI: only run sonarqube task when token is known