fix(sarif): SARIF_HASH computed before test-sarif deletion; upload failures silently swallowed

[credfeto]

Found during AI review of all workflows/actions.

Problems (all in .github/actions/sarif/action.yml)

1. Lines 17-21 — ${{hashfiles('**/*.sarif')}} is evaluated when the step starts, i.e. before the rm -rf *.Tests.sarif on the previous line takes effect. If the only sarif files were test ones, SARIF_HASH is non-empty and the upload runs on an effectively empty set. hashfiles also matches relative to the workspace, not the step's working-directory: results/ — it works only by accident.
2. Lines 27,36 — continue-on-error: true on the upload and summary steps: SARIF upload failures (auth, quota, malformed) pass silently and code-scanning results just stop appearing with a green build. Line 40 then prints a possibly-empty sarif-id.
3. Lines 3-4 — description is "Builds and deploys the source" (copy-paste); line 21 has unquoted >> $GITHUB_ENV.

Plan

• Split delete and hash into separate steps, or compute presence in bash (find . -name '*.sarif' ! -name '*.Tests.sarif' | head -1).
• Remove blanket continue-on-error; if forks/private repos legitimately cannot upload, gate on an explicit condition instead.
• Fix description; quote the redirect; pass sarif-id via env: (covered by the injection round-2 issue too).

[dnyw4l3n13]

Implementation Plan

Files to change

• .github/actions/sarif/action.yml - fix the hashfiles()-before-rm ordering bug, replace the blanket continue-on-error on the upload/summary steps with fork-only tolerance, fix the copy-pasted description, and quote the $GITHUB_ENV redirect
• .github/actions/build/action.yml - pass the already-computed steps.visibility.outputs.is_fork through to the sarif action's new repo-fork input at its "Upload SARIF file for diagnostics" call site
• .github/workflows/pr-lint.yml - same wiring at its "Upload SARIF file for diagnostics" call site, which already runs ./.github/actions/check-repo-visibility as step visibility

Approach

In sarif/action.yml, replace the hashfiles('**/*.sarif') expression (which is templated into the script before the step runs, i.e. before that same step's rm -rf *.Tests.sarif executes, and which resolves relative to the workspace rather than the working-directory: results/ the step actually uses) with a bash-native check run after the rm, e.g. find . -maxdepth 1 -name '*.sarif' -print -quit inside the results/ working directory, exported as SARIF_HASH/SARIF_PRESENT via a quoted >> "$GITHUB_ENV" redirect. Add a new required repo-fork input ('true'/'false', mirroring the existing repo-visibility input's string-boolean convention) to the action, and change the if: conditions on the upload and summary steps to keep the existing inputs.repo-visibility == 'public' gate unchanged, while making continue-on-error conditional: continue-on-error: ${{inputs.repo-fork == 'true'}}. This keeps the current behaviour for forked-repo runs (where the token is read-only and an upload failure is expected and unactionable) but turns upload/summary failures into real job failures on same-repo runs, so a broken upload is visible instead of silently swallowed. Update the two call sites to pass repo-fork: ${{steps.visibility.outputs.is_fork}} alongside the existing repo-visibility input - both already run check-repo-visibility as step id visibility earlier in the same job, so no new step is needed. Also fix the description: field (currently "Builds and deploys the source", copy-pasted from an unrelated action) to describe what this action actually does.

Test strategy

This is composite-action YAML with no dedicated test harness in this repo; verification is via the pre-commit baseline hook (actionlint, composite-action-lint, yamllint) run over the changed files, plus a manual read-through of the resulting if/continue-on-error expressions against both call sites to confirm the fork/non-fork behaviour matches the intent above. The actual runtime behaviour (hash computed after deletion, upload failures surfacing on non-fork runs) will be exercised for real once this PR's own CI runs the build and pr-lint workflows, which both invoke the changed action.

Assumptions

• steps.visibility.outputs.is_fork (from check-repo-visibility) is a reliable signal for "the GITHUB_TOKEN is read-only and an upload failure here is expected", per the existing precedent in sarif-summary/action.yml's fork-aware continue-on-error comment.
• No other workflows or actions call ./.github/actions/sarif beyond build/action.yml and pr-lint.yml (confirmed by repo-wide search).
• Passing sarif-id via env: in the summary step is already correct as-is (per the issue's note that this is covered by a separate injection-hardening issue) and needs no change here.

Open questions

None - ready to proceed pending approval.

[dnyw4l3n13]

This item's agent container has failed 5 times in a row before Claude could even start (a pre-flight/infra failure, not a Claude-level one — e.g. a workspace-trust or environment check in entrypoint.sh). Blocking for a human to investigate the container/image rather than retrying forever.