Security Issues in GitHub Step Summary is empty

Describe the bug

How to get to see the vulnerabilities in the GitHub Step Summary?
I tried everything... Nothing is working.
Documentation barely exists.

Generating Job Summary
  /home/runner/_work/_tool/jf/2.88.0/x64/jf generate-summary-markdown
  Warning: Failed populating code scanning sarif: HttpError: Unknown error: {"msg":"Invalid SARIF document: No valid runs found."}

What does this even mean?

I tried setting --format sarif for both jf docker scan and jf build-scan... Uploading the sarif files... Nothing works... The columns remain empty or show Not scanned...

Current behavior

nothing is displayed in the Security Issues column

Reproduction steps

In a GitHub workflow:

• build & push Docker image with docker/build-push-action
• jf docker scan
• jf rt build-docker-create
• jf rt build-collect-env
• jf rt build-add-git
• jf rt build-publish
• jf build-scan

Result: the Security Issues columns are completely empty.

Expected behavior

To see the vulnerabilities

JFrog CLI-Security version

?

JFrog CLI version (if applicable)

2.88.0

Operating system type and version

Ubuntu

JFrog Xray version

latest

Start by reproducing the listed GitHub workflow with JFrog CLI 2.88.0 on Ubuntu, including jf docker scan, jf rt build-* commands, and jf build-scan. Inspect the “Invalid SARIF document: No valid runs found” warning and compare the generated summary with the uploaded SARIF; done means vulnerabilities appear in the Security Issues column without empty or “Not scanned” results.