ci: retain security reports as workflow artifacts

[batuthzcode]

Summary

• upload the three static-analysis JSON reports as one workflow artifact
• upload the dependency/CVE JSON report as a separate workflow artifact
• retain both artifacts for 14 days
• use run-attempt-specific names so workflow reruns do not collide
• fail closed when a required report is missing or empty
• pin actions/upload-artifact to the immutable v7.0.1 commit
• document artifact scope, retention, permissions, and failure behavior

Why

The security jobs already generated and validated machine-readable reports, but those files disappeared with the runner workspace. Reviewers and maintainers could see only the job result, not retrieve the exact reports produced by a specific run.

This change publishes the validated JSON files directly from their producer jobs without adding an aggregation job, cross-job downloads, repository write permission, or project secrets.

Artifact contract

Static analysis

Artifact: static-analysis-reports-${{ github.run_attempt }}

Contents:

• reports/ci/static-analysis-src.json
• reports/ci/static-analysis-tools.json
• reports/ci/static-analysis-sample-app.json

Dependency scan

Artifact: dependency-scan-report-${{ github.run_attempt }}

Contents:

• reports/ci/dependency-scan.json

Failure and security behavior

• required reports are checked with Bash -s before upload
• missing or empty reports keep the job failed
• if-no-files-found: error provides a second fail-closed guard
• upload steps run after earlier failures when the run is not cancelled, preserving available diagnostic reports
• cancelled runs do not publish incomplete artifacts
• artifacts expire after 14 days
• only JSON reports are uploaded; source checkouts, caches, logs, and credentials are excluded
• workflow permissions remain contents: read
• continue-on-error is not used

Validation

• GitHub Actions run #9: Tests, Static analysis, and Dependency scan passed
• GitHub Actions full suite: 1000 passed
• GitHub Actions dependency validation: 19 passed
• local full suite: 1000 passed
• local CI workflow contract suite: 16 passed
• workflow YAML parse: passed
• static and dependency verifier Bash syntax: passed
• sample-app report drift check: passed
• tools self-analysis: zero findings
• git diff --check: passed

Published artifact verification

Run #9 published exactly two non-expired artifacts for head 0dc3b5974d588e4a616cd12037544dd6326dfa8d:

• static-analysis-reports-1
  • upload log confirmed the three expected JSON paths and exactly 3 files
  • size: 901 bytes
  • digest: sha256:63a483ab193f221344963c300989559eabee8e63a18663fb0eb484b15b52cdd3
  • expires: 2026-09-01
• dependency-scan-report-1
  • upload log confirmed reports/ci/dependency-scan.json and exactly 1 file
  • size: 901 bytes
  • digest: sha256:eedfb94a1dcac1fd42cc194c1db2eefa96872a368359115c69360315ba0cf4f6
  • expires: 2026-09-01

Follow-up

Backlog 5.5 will complete remaining test coverage and whole-project self-analysis work.