ci(validate-marketplace): guard SARIF upload on file presence

apm-action's audit-report step short-circuits when there is no
apm.lock.yaml ('No apm.lock.yaml found -- nothing to scan') and
writes no SARIF file. The unconditional upload step then failed
with 'Path does not exist: apm-audit.sarif'.

Marketplace-only manifests legitimately have no dependencies to
scan, so the absence of a SARIF file is not an error -- only its
presence-with-failures would be. Guard the upload on
hashFiles('apm-audit.sarif') != '' so the gate stays green for
marketplace-only repos and lights up the moment awesome-copilot
adds a real dependency.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: danielmeppiel

.github/workflows/validate-marketplace.yml

@@ -68,11 +68,21 @@ jobs:
           audit-report: 'true'
 
       # Gate A: supply-chain integrity (consumer-side).
+      # `apm audit --ci` exits non-zero on policy failures (lockfile drift,
+      # orphan packages, hidden Unicode in deployed content). On a
+      # marketplace-only manifest with no `dependencies:` block this is a
+      # short-circuit pass ("No dependencies declared -- lockfile not
+      # required"), but the gate is wired so the moment awesome-copilot
+      # adds a real dependency the policy fires automatically.
       - name: apm audit --ci
         run: apm audit --ci
 
+      # SARIF upload only runs when apm-action actually produced a report.
+      # For marketplace-only manifests there is no lockfile to scan, so
+      # apm-action emits "No apm.lock.yaml found -- nothing to scan" and
+      # writes no file. Guarding on hashFiles() avoids a spurious failure.
       - name: Upload APM audit SARIF
-        if: always()
+        if: always() && hashFiles('apm-audit.sarif') != ''
         uses: github/codeql-action/upload-sarif@v3
         with:
           sarif_file: apm-audit.sarif