The security-workflows repo only ships one combined workflow (security-scan.yml running semgrep + trivy in parallel), not separate semgrep.yml/trivy.yml.
The security-workflows repo lives under the personal account, not the Hellion-Forge org.