#64893 Don't attempt to upload a SARIF to GitHub Code Security on private repos

[johnbillion]

GitHub Code Security is not enabled on any of the private mirrors. This change prevents this workflow from attempting and failing to upload a SARIF to GitHub Code Security on private repos.

Trac ticket: https://core.trac.wordpress.org/ticket/64893

Use of AI Tools

AI assistance: None

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props johnbillion.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[Copilot]

Pull request overview

This PR updates the reusable GitHub Actions workflow linter to avoid attempting (and failing) SARIF uploads to GitHub Code Security on private repository mirrors, where Code Security is not enabled.

Changes:

• Adds a conditional guard intended to prevent SARIF upload behavior on private repositories.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[lancewillett]

No blockers.

Avoiding this error looks fine. We don't need separate coverage on a private mirror.

(I disagree with Copilot, though. Gating only the upload wouldn't help: with --format=sarif zizmor writes to a file and exits 0 even when it has findings, so this mirror would see nothing either way.)