ci(pr): InspectCode builds PR code with no write scope; SARIF upload moves to a no-checkout job

.github/workflows/pr.yaml

@@ -343,7 +343,6 @@ jobs:
     timeout-minutes: 20
     permissions:
       contents: read
-      security-events: write   # required for upload-sarif
 
     steps:
       - name: Checkout code
@@ -458,10 +457,16 @@ jobs:
             --severity=WARNING \
             --no-build
 
-      - name: Upload SARIF to Code Scanning
-        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+      - name: Hand the SARIF to the upload job
+        # Runs even when the gate below fails so warning-level findings still reach
+        # Code Scanning; the upload job holds the write scope this job does not.
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
-          sarif_file: inspect.sarif
+          name: inspectcode-sarif
+          path: inspect.sarif
+          if-no-files-found: ignore
+          retention-days: 1
 
       - name: Gate on error-severity findings
         # PowerShell (native on windows-latest) so we don't depend on jq
@@ -486,6 +491,46 @@ jobs:
           Write-Host "✅ No error-severity InspectCode findings."
 
 
+
+  # ============================================================================
+  # INSPECTCODE UPLOAD: the only job with security-events: write. It never checks
+  # out PR code — the checkout below is the trusted base ref (pull_request_target
+  # default), which upload-sarif needs only to resolve the workspace — and it
+  # uploads the SARIF the job above produced. Runs after a gate failure too (the
+  # warnings are the point) but not when the analysis never ran.
+  # ============================================================================
+  inspectcode-upload:
+    name: "ReSharper InspectCode (upload SARIF)"
+    runs-on: ubuntu-latest
+    needs: inspectcode
+    if: always() && (needs.inspectcode.result == 'success' || needs.inspectcode.result == 'failure')
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      security-events: write   # required for upload-sarif
+      actions: read            # upload-sarif reads the workflow run to associate the analysis
+
+    steps:
+      - name: Checkout trusted base ref
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Download the SARIF
+        id: sarif
+        # A build that died before `jb inspectcode` produced nothing to upload; the
+        # artifact is then absent and this job ends quietly instead of failing twice.
+        continue-on-error: true
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: inspectcode-sarif
+
+      - name: Upload SARIF to Code Scanning
+        if: steps.sarif.outcome == 'success' && hashFiles('inspect.sarif') != ''
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
+        with:
+          sarif_file: inspect.sarif
+
   # ============================================================================
   # STAGE 1: Linux - .NET Core/5+ Tests with Coverage Gate
   # ============================================================================