Let advisory Hypatia callers skip pull-request SARIF upload #1327

Problem

hypatia-scan-reusable.yml documents its default mode as advisory / non-blocking, but it always uploads SARIF on pull_request. Hypatia maps critical and high findings to SARIF error; GitHub then creates a separate code-scanning-results check and fails it when those alerts touch changed lines. The reusable job can therefore be green and explicitly say it "never fails the build" while its upload fails the PR through a second check.

Concrete example: hyperpolymath/MetaManifold-WebUI#224, check run 120302293713. The Hypatia verdict grid / Hypatia Neurosymbolic Analysis job succeeded, while Code scanning results / Hypatia failed on two new TypeScript files with cicd_rules/banned_language_file. The fork intentionally keeps that upstream-policy divergence visible in its verdict grid rather than baselining it away.

A baseline is not a general fix for this contradiction: it changes finding visibility, and adding a baseline plus scripts/apply-baseline.sh also activates the reusable's blocking baseline gate over all other current findings.

Proposed change

Add a boolean workflow input, defaulting to current behaviour for compatibility, for example:

upload-sarif-on-pull-request:
  description: Upload SARIF for pull_request events; disable for artifact/grid-only advisory scans
  type: boolean
  required: false
  default: true

Guard only the upload step:

if: github.event_name != 'pull_request' || inputs.upload-sarif-on-pull-request

Scanning, JSON findings, artifacts, SARIF generation, and verdict-grid rendering should remain unchanged. Push and manual uploads should also remain unchanged so default-branch alerts continue to reconcile.

Please add a contract test proving that disabling the input skips only the PR upload and does not skip the scan or its evidence.

Interim consumer fix

hyperpolymath/MetaManifold-WebUI#231 uses a documented fork-local copy with this event boundary and a regression contract. It can return to the standards reusable once an equivalent input is available.