Disable Docker Scout PR comment to prevent accidental @mentions

[IhorMasechko]

We disabled Docker Scout auto-comments in CI by setting write-comment: false in the security-scan job.
This prevents scoped package names like @apostrophecms/... from being parsed as GitHub mentions and notifying unrelated users.
Security scanning is still active and results are still uploaded via SARIF.

Disabled Docker Scout's automatic PR comments by configuring write-comment: false in the security-scan job within the CI workflow. This prevents scoped package names, such as @apostrophecms/..., from being incorrectly parsed as GitHub user mentions that would notify unrelated users. Security scanning remains fully active and SARIF results continue to be uploaded as before.

[coderabbitai]

Walkthrough

The pull request modifies .github/workflows/code-quality.yml to disable PR comment reporting for the Docker Scout scan step by adding write-comment: false to the step's configuration. This prevents the scan action from automatically posting results as a comment on pull requests. No other workflow logic, inputs, or control flow changes were made.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: disabling Docker Scout's PR comment feature to prevent @mentions. It is concise (63 characters), well under the 75-character requirement, and directly relates to the changeset modification.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/code-quality.yml (1)

31-33: ⚠️ Potential issue | 🟡 Minor

Remove unnecessary pull-requests: write permission.

The github/codeql-action/upload-sarif action requires only security-events: write to upload SARIF files. Since Docker Scout scanning now has write-comment: false, no step in this job needs to write to pull requests.

Proposed change

     permissions:
       security-events: write
-      pull-requests: write

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/code-quality.yml around lines 31 - 33, Remove the
unnecessary pull-requests write permission from the workflow permissions block:
delete the "pull-requests: write" entry so only "security-events: write"
remains; update the permissions mapping in the code-quality job (the permissions
YAML block containing security-events and pull-requests) to stop granting
pull-request write access since upload-sarif only needs security-events and no
step writes PRs.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Outside diff comments:
In @.github/workflows/code-quality.yml:
- Around line 31-33: Remove the unnecessary pull-requests write permission from
the workflow permissions block: delete the "pull-requests: write" entry so only
"security-events: write" remains; update the permissions mapping in the
code-quality job (the permissions YAML block containing security-events and
pull-requests) to stop granting pull-request write access since upload-sarif
only needs security-events and no step writes PRs.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 6da0e92b-cb7c-4e54-b26d-c58f6a26312e

📥 Commits

Reviewing files that changed from the base of the PR and between 2d19c8f and a01c1d0.

📒 Files selected for processing (1)

• .github/workflows/code-quality.yml