Don't block master builds on grype reports

Signed-off-by: Dimitris Karakasilis <dimitris@spectrocloud.com>

Author: jimmykarily

.github/workflows/image-master-arm.yaml

@@ -29,7 +29,9 @@ jobs:
       arch: "arm64"
       version: "auto"
       grype: ${{ matrix.grype }}
-      security_scan_mode: "enforce"
+      # Report-only: the scan still runs and reports, but criticals from the
+      # upstream base image must not block master builds / tests.
+      security_scan_mode: "report-only"
       registry_domain: "quay.io"
       registry_namespace: "kairos"
       registry_repository: "ci-temp-images"

.github/workflows/image-master.yaml

@@ -47,7 +47,9 @@ jobs:
             base_image: "ghcr.io/kairos-io/hadron:v0.3.0"
             kubernetes_distro: ""
             custom_job_name_format: "core-amd64-generic"
-            security_scan_mode: "enforce"
+            # Report-only: the scan still runs and reports, but criticals from
+            # the upstream base image must not block master builds / tests.
+            security_scan_mode: "report-only"
           - image_name: "hadron"
             base_image: "ghcr.io/kairos-io/hadron:v0.3.0"
             kubernetes_distro: "k3s"