Fork PRs (and Dependabot PRs) never receive repository secrets, so the
Docker Hub login ran with empty credentials and Docker Scout then died
with "user githubactions not entitled to use Docker Scout". Every
external contributor got a red docker check they could not do anything
about (#368, #356, #357, #359).
- Gate the Docker Hub login and both Scout PR steps on the PR coming
from this repo, the same guard the login/push/comment steps already use.
- Add a Trivy scan of the locally loaded image on every PR. It needs no
credentials, so forks get real vulnerability feedback. Output goes to
the job summary because GITHUB_TOKEN is read-only on fork PRs.
- Only upload the Scout SARIF when a file exists, so fork PRs stop
logging "Path does not exist: scout-results.sarif".
- Update the workflows README, which still described a docker-scan.yml
that no longer exists.
Not using pull_request_target on purpose: it would run untrusted PR code
with the Docker Hub token available.
