diff --git a/.github/workflows/ci-pr.yml b/.github/workflows/ci-pr.yml
index 0ff50060..3b355e0a 100644
--- a/.github/workflows/ci-pr.yml
+++ b/.github/workflows/ci-pr.yml
@@ -127,8 +127,9 @@ jobs:
       - name: Scan Jar files
         shell: bash
         run: |
+          ROOT_DIR=$(realpath $PWD)
           pushd stream-applications > /dev/null
-            ./scan-folders.sh table
+            $ROOT_DIR/scan-folders.sh table
           popd > /dev/null
       - name: 'Upload: Error logs'
         if: ${{ failure() }}
diff --git a/.github/workflows/common.yml b/.github/workflows/common.yml
index 6e5e9a10..dc6c73fb 100644
--- a/.github/workflows/common.yml
+++ b/.github/workflows/common.yml
@@ -360,11 +360,12 @@ jobs:
       - name: Scan Jar files
         shell: bash
         run: |
+          ROOT_DIR=$(realpath $PWD)
           pushd stream-applications > /dev/null
-            ./scan-folders.sh
+            $ROOT_DIR/scan-folders.sh
           popd > /dev/null
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v2
+        uses: github/codeql-action/upload-sarif@v3
         with:
           sarif_file: 'stream-applications/scan.sarif'
       - name: 'Configure: Docker login'
@@ -499,11 +500,12 @@ jobs:
       - name: Scan Jar files
         shell: bash
         run: |
+          ROOT_DIR=$(realpath $PWD)
           pushd stream-applications > /dev/null
-            ./scan-folders.sh
+            $ROOT_DIR/scan-folders.sh
           popd > /dev/null
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v2
+        uses: github/codeql-action/upload-sarif@v3
         with:
           sarif_file: 'stream-applications/scan.sarif'
       - name: 'Configure: Docker login'
@@ -639,11 +641,12 @@ jobs:
       - name: Scan Jar files
         shell: bash
         run: |
+          ROOT_DIR=$(realpath $PWD)
           pushd stream-applications > /dev/null
-            ./scan-folders.sh
+            $ROOT_DIR/scan-folders.sh
           popd > /dev/null
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v2
+        uses: github/codeql-action/upload-sarif@v3
         with:
           sarif_file: 'stream-applications/scan.sarif'
       - name: 'Configure: Docker login'
diff --git a/scan-folders.sh b/scan-folders.sh
index 60241357..06853473 100755
--- a/scan-folders.sh
+++ b/scan-folders.sh
@@ -11,9 +11,10 @@ while [ "$1" != "" ]; do
   fi
   shift
 done
-find $SCDIR -type d -name target -exec bash "$SCDIR/scan-jars.sh" '{}' \;
+find . -type d -name target -exec bash "$SCDIR/scan-jars.sh" '{}' \;
+echo "{\"version\": \"2.1.0\", \"\$schema\": \"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json\", \"runs\": [" > "$SCDIR/scan.sarif"
 if [ -f "$SCDIR/runs.sarif" ]; then
-  echo "{\"version\": \"2.1.0\", \"\$schema\": \"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json\", \"runs\": [" > $SCDIR/scan.sarif
-  cat "$SCDIR/runs.sarif" >> $SCDIR/scan.sarif
-  echo "]}" >> $SCDIR/scan.sarif
+  cat "$SCDIR/runs.sarif" >> "$SCDIR/scan.sarif"
 fi
+echo "]}" >> "$SCDIR/scan.sarif"
+echo "Created $SCDIR/scan.sarif"