[CI] Fix Trivy scan in both CI and CI PR workflows (take2)

.github/workflows/ci.yml

@@ -21,6 +21,7 @@ env:
   ARTIFACTORY_USERNAME: ${{ secrets.ARTIFACTORY_USERNAME }}
   ARTIFACTORY_PASSWORD: ${{ secrets.ARTIFACTORY_PASSWORD }}
 
+jobs:
   prerequisites:
     name: Pre-requisites for building
     runs-on: ubuntu-latest
@@ -88,11 +89,7 @@ env:
     uses: ./.github/workflows/trivy-scan.yml
     with:
       config-path: .github/trivy-to-sarif.yaml
-  upload_scan_to_github:
-    needs: [scan]
-    uses: github/codeql-action/upload-sarif@v2
-    with:
-      sarif_file: 'trivy-results.sarif'
+      upload-results: true
   deploy_artifacts:
     name: Deploy Artifacts
     needs: [build_jdk_17, check_samples, scan]

.github/workflows/trivy-scan.yml

@@ -8,7 +8,11 @@ on:
         default: '.github/trivy-to-console.yaml'
         required: false
         type: string
-
+      upload-results:
+        description: 'Upload scan results to Github?'
+        default: false
+        required: false
+        type: boolean
   workflow_call:
     inputs:
       config-path:
@@ -16,6 +20,11 @@ on:
         default: '.github/trivy-to-console.yaml'
         required: false
         type: string
+      upload-results:
+        description: 'Upload scan results to Github?'
+        default: false
+        required: false
+        type: boolean
 
 jobs:
   run_trivy_scan:
@@ -35,3 +44,8 @@ jobs:
           scan-type: 'fs'
           scan-ref: '${{ env.LOCAL_REPOSITORY_PATH }}/org/springframework/pulsar'
           trivy-config: ${{ inputs.config-path }}
+      - name: Upload Trivy scan results to GitHub Security tab
+        if: inputs.upload-results
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: 'trivy-results.sarif'