Don't block PRs on grype reports

The PR core jobs were the last gates still in enforce mode, so every PR
fails on criticals from the upstream base image (out of our control).
Mirror master and release builds: keep the scan running and reporting,
but make it report-only so it no longer blocks PRs.

Now no active scan gate blocks on the base-image CVEs; uki.yaml keeps
enforce but runs with grype disabled, so it is inert.

Signed-off-by: Dimitris Karakasilis <dimitris@spectrocloud.com>

Author: jimmykarily

.github/workflows/image-pr-arm.yaml

@@ -61,7 +61,9 @@ jobs:
       version: "auto"
       raw: ${{ matrix.model == 'rpi3' || matrix.model == 'rpi4' }} # only produce raw images for rpi3 and rpi4
       grype: ${{ matrix.grype }}
-      security_scan_mode: "enforce"
+      # Report-only: the scan still runs and reports, but criticals from the
+      # upstream base image must not block PRs. Mirrors master / release builds.
+      security_scan_mode: "report-only"
       registry_domain: "quay.io"
       registry_namespace: "kairos"
       registry_repository: "ci-temp-images"

.github/workflows/image-pr.yaml

@@ -39,7 +39,9 @@ jobs:
       version: "auto"
       iso: true
       grype: true
-      security_scan_mode: "enforce"
+      # Report-only: the scan still runs and reports, but criticals from the
+      # upstream base image must not block PRs. Mirrors master / release builds.
+      security_scan_mode: "report-only"
       registry_domain: "quay.io"
       registry_namespace: "kairos"
       registry_repository: "ci-temp-images"