Guard SARIF upload against missing files from failed Trivy scans

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -70,9 +70,17 @@ jobs:
           severity: 'CRITICAL,HIGH'
           skip-setup-trivy: true
 
+      - name: Check for SARIF files
+        id: sarif-check
+        if: always()
+        run: |
+          if ls *.sarif 1>/dev/null 2>&1; then
+            echo "exists=true" >> $GITHUB_OUTPUT
+          fi
+
       - name: Upload Trivy scan results to GitHub Security tab
         uses: github/codeql-action/upload-sarif@v4
-        if: always()
+        if: always() && steps.sarif-check.outputs.exists == 'true'
         with:
           sarif_file: '.'