fix(ci): make the code-scanning SARIF upload best-effort (regression from #47)

[felixgeelhaar]

This fixes a regression I introduced in #47. Merging it promptly matters — it can fail the Security job on every private repo in the fleet.

What happened

#47 corrected the SARIF lookup from findings.sarif (a filename nox never writes) to results.sarif. That was right, but it made the upload step reachable for the first time — and it immediately failed on lexora:

##[error]Resource not accessible by integration

Code-scanning ingest requires GitHub Advanced Security on private repositories. Most of the fleet is private (lexora, nexa, armada, episteme-api, vorhut, brotwerk, …). While the step was looking for a filename that never existed, hashFiles() never matched, so the missing permission could never surface. Fixing the lookup exposed a latent problem.

This is the same trap as the original bug, one layer down: a step that silently skipped was concealing something, and the concealment was mistaken for health.

The fix

continue-on-error: true, because this upload is reporting, not enforcement.

The gate step is what decides pass/fail, and it is unaffected. On the very same lexora run it worked correctly:

net-new critical/high: 0 (baselined findings: 57)

That is the gate executing properly for the first time in that repo — matching my local scan exactly. A repo without Advanced Security should still get its security gate; it just does not also get findings mirrored into the code-scanning UI.

The file already applies this reasoning to the taint-plugin install, for the same reason:

continue-on-error: this is an ENHANCEMENT, not a requirement … a plugin-registry hiccup silently disables security scanning for every repo on this workflow.

Scope

Both go-ci.yml and js-ci.yml. Public repos (warden, mnemos, bolt, keyward) are unaffected either way — their uploads succeed, and warden's main is green post-#47.

[felixgeelhaar]

Amending the diagnosis in the description above — the fix is right, but I attributed it to a single cause and there are two.

I wrote that the upload fails because code-scanning ingest needs Advanced Security on private repos. That is true for lexora (private). But briefkasten is public, and it failed the same step for an entirely different reason:

##[error]Code Scanning could not process the submitted SARIF file:
locationFromSarifResult: expected artifact location

nox/reachability emits REACH-001 — a module-level verdict, "the vulnerable symbol in x/crypto is never called" — which has no file to point at, so nox serializes artifactLocation.uri: "". GitHub rejects the whole file over it. Reproduced locally: 1 result, 1 malformed. Filed as Nox-HQ/nox#366.

So continue-on-error is covering two independent classes: a missing platform capability, and malformed SARIF. Both are reporting-layer problems that should not fail an enforcement job, so the fix stands — but "private repos" alone would have been a misleading thing to leave in the record.

Blast radius of the #47 window, checked across all 28 fleet repos: exactly two runs affected (lexora, briefkasten). Reachability is enabled on no repo's default branch — only briefkasten's PR branch — so #366 is contained.