Cannot upload reports as artifacts due to permission issues

[erzz]

- name: Run tfsec
  uses: aquasecurity/[email protected]
  with:
    github_token: ${{ secrets.token }}
    working_directory: ${{ inputs.path }}
    tfsec_version: ${{ inputs.tfsec-version }}
    tfsec_args: ${{ inputs.tfsec-args }}
    tfsec_formats: junit,sarif
    commenter_version: latest

- uses: actions/upload-artifact@v3
  with:
    name: tfsec reports
    path: results.*

The files are found - but the upload action reports something like the following:

Run actions/upload-artifact@v3
With the provided path, there will be 4 files uploaded
Starting artifact upload
For more detailed logs during the artifact upload process, enable step-debugging: https://docs.github.com/actions/monitoring-and-troubleshooting-workflows/enabling-debug-logging#enabling-step-debug-logging
Artifact name is valid!
Container for artifact "tfsec results" successfully created. Starting upload of file(s)
node:events:3[6](https://github.com/my-org/my-project/runs/6570977067?check_suite_focus=true#step:5:7)8
      throw er; // Unhandled 'error' event
      ^

Error: EACCES: permission denied, open '/home/runner/work/my-project/my-project/results.json'
Emitted 'error' event on ReadStream instance at:
    at emitErrorNT (node:internal/streams/destroy:15[7](https://github.com/my-org/my-project/runs/6570977067?check_suite_focus=true#step:5:8):[8](https://github.com/my-org/my-project/runs/6570977067?check_suite_focus=true#step:5:9))
    at emitErrorCloseNT (node:internal/streams/destroy:[12](https://github.com/my-org/my-project/runs/6570977067?check_suite_focus=true#step:5:13)2:3)
    at processTicksAndRejections (node:internal/process/task_queues:83:21) {
  errno: -[13](https://github.com/my-org/my-project/runs/6570977067?check_suite_focus=true#step:5:14),
  code: 'EACCES',
  syscall: 'open',
  path: '/home/runner/work/my-project/my-project/results.json'
}

I even tried non-wildcard versions, globbed paths, non-globbed and adding a step that first copied reports to another directory but that also got a permission denied