ci(scorecard): move SARIF debug to separate job to satisfy scorecard restrictions

.github/workflows/scorecard.yml

@@ -58,13 +58,6 @@ jobs:
 
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
-      - name: "Show SARIF file"
-        run: |
-          echo "SARIF file listing:"
-          ls -la results.sarif || true
-          echo "SARIF file type (if available):"
-          file results.sarif || true
-
       - name: "Upload artifact"
         uses: actions/upload-artifact@v7
         with:
@@ -79,3 +72,20 @@ jobs:
         uses: github/codeql-action/upload-sarif@1b1aada464948af03b950897e5eb522f92603cc2 # v3.24.9
         with:
           sarif_file: results.sarif
+
+  inspect-sarif:
+    name: Inspect SARIF artifact
+    needs: analysis
+    runs-on: ubuntu-latest
+    steps:
+      - name: "Download SARIF artifact"
+        uses: actions/download-artifact@v3
+        with:
+          name: results-sarif
+
+      - name: "List SARIF file"
+        run: |
+          echo "Downloaded files:"
+          ls -la || true
+          echo "If results.sarif is present, show basic info:"
+          file results.sarif || true