fix(ci): skip audit comment gracefully when report artifact missing (#96)

Post Security Audit Comment hard-failed (setFailed) whenever the
triggering audit run produced no artifact, e.g. failed pre-upload
audit runs on closed PRs. Each failure mailed subscribers, and
re-running could never succeed. Emit a warning and skip the
download/extract/post steps instead.

.github/workflows/skill-security-audit-comment.yml

@@ -19,6 +19,7 @@ jobs:
       actions: read
     steps:
       - name: Download audit report artifact
+        id: download
         uses: actions/github-script@v9
         with:
           script: |
@@ -29,9 +30,11 @@ jobs:
             });
             const match = artifacts.data.artifacts.find(a => a.name === 'security-audit-report');
             if (!match) {
-              core.setFailed('No security-audit-report artifact found');
+              core.warning('No security-audit-report artifact found; skipping comment.');
+              core.setOutput('found', 'false');
               return;
             }
+            core.setOutput('found', 'true');
             const download = await github.rest.actions.downloadArtifact({
               owner: context.repo.owner,
               repo: context.repo.repo,
@@ -42,11 +45,13 @@ jobs:
             fs.writeFileSync('${{ runner.temp }}/report.zip', Buffer.from(download.data));
 
       - name: Extract artifact
+        if: steps.download.outputs.found == 'true'
         run: |
           mkdir -p "${{ runner.temp }}/report"
           unzip -o "${{ runner.temp }}/report.zip" -d "${{ runner.temp }}/report"
 
       - name: Post or update PR comment
+        if: steps.download.outputs.found == 'true'
         uses: actions/github-script@v9
         with:
           script: |