Don't enforce security scans on master

because k3s CVEs our no in our control and it's blocking the rest of
the tests from running.

Signed-off-by: Dimitris Karakasilis <dimitris@karakasilis.me>

Author: jimmykarily

.github/workflows/image-master.yaml

@@ -29,7 +29,7 @@ jobs:
       version: "auto"
       iso: true
       grype: true
-      security_scan_mode: "enforce"
+      security_scan_mode: ${{ matrix.security_scan_mode }}
       registry_domain: "quay.io"
       registry_namespace: "kairos"
       registry_repository: "ci-temp-images"
@@ -47,7 +47,11 @@ jobs:
             base_image: "ghcr.io/kairos-io/hadron:v0.3.0"
             kubernetes_distro: ""
             custom_job_name_format: "core-amd64-generic"
+            security_scan_mode: "enforce"
           - image_name: "hadron"
             base_image: "ghcr.io/kairos-io/hadron:v0.3.0"
             kubernetes_distro: "k3s"
             custom_job_name_format: "standard-amd64-generic-k3s"
+            # Report-only: k3s CVEs come from upstream and should not block
+            # master builds / tests. Mirrors release.yaml (PR #4052).
+            security_scan_mode: "report-only"