ci(scorecard): fix workflow artifact handling

.github/workflows/scorecard.yml

@@ -32,7 +32,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ffd01eeb3 # v6.0.0
         with:
           persist-credentials: false
 
@@ -59,9 +59,10 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@97a0fba1372883ab732affbe8f94b823f91727db # v3.pre.node20
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
-          name: SARIF file
+          # Use a simple, lowercase artifact name without spaces to avoid API validation
+          name: results-sarif
           path: results.sarif
           retention-days: 5
 
@@ -71,3 +72,20 @@ jobs:
         uses: github/codeql-action/upload-sarif@1b1aada464948af03b950897e5eb522f92603cc2 # v3.24.9
         with:
           sarif_file: results.sarif
+
+  inspect-sarif:
+    name: Inspect SARIF artifact
+    needs: analysis
+    runs-on: ubuntu-latest
+    steps:
+      - name: "Download SARIF artifact"
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          name: results-sarif
+
+      - name: "List SARIF file"
+        run: |
+          echo "Downloaded files:"
+          ls -la || true
+          echo "If results-sarif/results.sarif is present, show basic info:"
+          file results-sarif/results.sarif || true