fix(security): upload evidence only when the scan ran

.github/workflows/nddev-security-bundle.yml

@@ -147,7 +147,15 @@ jobs:
         run: "$NDDEV_SECURITY_BUNDLE_SCRIPT"
 
       - name: Upload redacted security evidence
-        if: ${{ always() }}
+        # Only when the gates actually ran. These uploads were `always()`, so a
+        # job that died in its own bootstrap -- before any scanner existed --
+        # ended by reporting `Path does not exist:
+        # .../private-security-zizmor.sarif`. That is a true statement about a
+        # file and a false statement about the run: the real failure was three
+        # steps earlier, and the message that reached the reviewer named the
+        # wrong thing entirely. Evidence is still uploaded when the scan runs
+        # and finds problems, which is the case `always()` was there for.
+        if: ${{ !cancelled() && steps.scan.conclusion != 'skipped' }}
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: nddev-private-security-evidence-${{ github.run_id }}-${{ github.run_attempt }}
@@ -161,7 +169,7 @@ jobs:
           compression-level: 9
 
       - name: Upload zizmor SARIF
-        if: ${{ always() }}
+        if: ${{ !cancelled() && steps.scan.conclusion != 'skipped' }}
         uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd  # v4.37.7
         with:
           sarif_file: ${{ runner.temp }}/private-security-zizmor.sarif

.github/workflows/private-security-bundle-free.yml

@@ -184,6 +184,7 @@ jobs:
           max-bytes: '16777216'
 
       - name: Run consolidated security gates without SARIF upload
+        id: scan
         shell: bash
         env:
           GH_TOKEN: ${{ github.token }}
@@ -201,7 +202,10 @@ jobs:
         run: "$PRIVATE_SECURITY_BUNDLE_SCRIPT"
 
       - name: Upload redacted security evidence
-        if: ${{ always() }}
+        # Only when the gates actually ran; see the note in
+        # nddev-security-bundle.yml. `always()` here turned a bootstrap failure
+        # into a missing-SARIF message that named the wrong step.
+        if: ${{ !cancelled() && steps.scan.conclusion != 'skipped' }}
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: ${{ inputs.evidence_artifact_name }}