ci(harden-gate): skip SARIF upload by condition on private repos, not continue-on-error

[github-actions]

📋 Description

Two of the three github/codeql-action/upload-sarif steps in .github/workflows/harden-gate.yml carried:

      - uses: github/codeql-action/upload-sarif@c4dd10e… # v3.37.6
        continue-on-error: true  # private repos lack code-scanning; report-only must stay green
        if: always()

The premise is true. The mechanism is not. continue-on-error swallows every failure of the step, so two very different outcomes produced the same green tick:

Outcome	What it means	What CI reported
Repo has no code scanning available	expected, benign	✅
SARIF malformed / action rejected the upload	the security gate is publishing nothing, and nobody is told	✅

This file already documents that exact failure — on the third step. The gate-dependency-scan comment reads: "continue-on-error hid the broken upload, so the job stayed green while the data never landed. Keep this step failing loudly: a dependency scan that silently does not report is worse than one that is visibly broken." The reasoning was correct and had only ever been applied where someone had already been bitten. It applies equally to the other two.

All three now carry an explicit condition instead:

      - name: Upload SARIF (skipped on private repos — code scanning unavailable)
        if: always() && !github.event.repository.private
        uses: github/codeql-action/upload-sarif@c4dd10e… # v3.37.6

🔄 Type of Change

• 🐛 Bug fix (non-breaking change which fixes an issue)
• 🔧 Refactoring (no functional change on the happy path)

🔧 Implementation Details

Changes Made

CI / workflow only — no frontend, backend, or SDK changes.

• gate-sast (semgrep) — continue-on-error: true → private-repo condition
• gate-authz (semgrep authz rules) — same
• gate-dependency-scan (trivy) — already failing loudly; the condition is added for uniformity, so a private consumer of this shape skips explicitly rather than hard-failing. Its "fail loudly" intent is unchanged on a public repo.

Why !…private and not … == false

Deliberate. If an event payload ever lacks repository, !null is truthy and the step runs — failing loudly on a private repo rather than silently skipping on a public one. For a security gate the safe direction is to run and go red, never to quietly not run.

What this does NOT change

The scans' own || true / exit-code: '0' are untouched. Report-only is a deliberate ratchet; flipping both in one change is a separate decision.

🧪 Testing

• Manual testing: yaml.safe_load on the edited file (parses, 16 jobs); the diff is 34 insertions / 8 deletions confined to the three upload steps; grep -E '^\s+continue-on-error:' now returns nothing.
• The real test is this PR's own Harden Gate run. FuzeFront is public, so all three uploads must now actually succeed — they can no longer report green after failing. If any of them reds here, that is a pre-existing broken upload this change has surfaced, and it is the finding.

🔗 Related Issues and PRs

• Matches izzywdev/FuzeSDLC#206, which makes the same change to the canonical workflow-templates/harden-gate.yml that this file descends from. Landing both keeps FuzeFront's copy from drifting further.

📝 Additional Notes

Deployment Notes

• No database migration, no environment variable changes, no dependency updates, no configuration changes.
• Workflow-only change; no application code is touched. The merge still runs the release path, as every merge to master does.

Future Work

The same two-line pattern is present in the other 18 fleet repos' copies of harden-gate.yml. Of the 20 repos, 5 are public (FuzeAgent, FuzeFront, FuzeInfra, FuzeKeys, FuzeX) and 15 private — the private ones gain honest skipped reporting, the public ones gain a genuinely failable upload. Propagation is tracked separately, because each repo carries a local copy the installer treats as UNTRACKED and never reconciles.

Note on how this PR was opened

The branch was pushed and the stranded-branch detector opened this PR and applied auto-merge, which is the repo's intended path per CLAUDE.md. The body was written after the fact; the diff and the commit message are the ones described above.

[izzywdev]

All CI gates pass (gate-authz, gate-ds-conformance, gate-identifier, gate-frames-first, gate-test, gate-lint, gate-build, gate-sast, gate-toolchain, gate-version, gate-localup, etc.). Approving per governance policy.