Investigate CI failure: SCA job 400 error after download-artifact v7 upgrade

[Copilot]

The SCA job fails with fatal: unable to access 'https://github.com/PossibleLlama/commit-check/': The requested URL returned error: 400 after bumping actions/download-artifact from v6 to v7.

Root Cause

actions/download-artifact@v7 introduced breaking changes in artifact access patterns:

• v7 only downloads artifacts from the current workflow run by default
• v6 allowed cross-workflow artifact downloads with simpler configuration
• The 400 error indicates permission/authentication issues when the SCA job attempts to access artifacts

Analysis

The SCA workflow in .github/workflows/golang-security.yaml likely depends on artifacts from previous jobs or runs. The v7 upgrade broke this dependency chain without corresponding configuration updates.

Recommended Fixes

1. Current workflow artifacts: Remove the name parameter to download all artifacts from the current run
2. Cross-workflow artifacts: Add github-token and run-id parameters to v7 configuration
3. Temporary workaround: Pin SCA workflow to actions/download-artifact@v6 until proper v7 migration is implemented

The workflow configuration needs updating to match v7's stricter artifact access model.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.