chore: gate codeql and trivy steps behind ENABLE_CODE_SCANNING var

Author: Medformatik

.github/workflows/codeql.yml

@@ -18,6 +18,11 @@ permissions:
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
+    # Code Scanning requires GitHub Advanced Security on private repos.
+    # To enable: make the repo public OR set repo variable
+    # ENABLE_CODE_SCANNING=true under Settings → Secrets and variables →
+    # Actions → Variables.
+    if: vars.ENABLE_CODE_SCANNING == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 60
     permissions:

.github/workflows/docker.yml

@@ -69,7 +69,12 @@ jobs:
           provenance: mode=max
           sbom: true
 
+      # Trivy scan + SARIF upload require Code Scanning, which needs
+      # GitHub Advanced Security on private repos. To enable: make the
+      # repo public OR set repo variable ENABLE_CODE_SCANNING=true
+      # under Settings → Secrets and variables → Actions → Variables.
       - name: Scan image with Trivy
+        if: vars.ENABLE_CODE_SCANNING == 'true'
         uses: aquasecurity/trivy-action@v0.36.0
         with:
           image-ref: ${{ env.IMAGE_PREFIX }}-${{ matrix.app }}@${{ steps.build.outputs.digest }}
@@ -80,7 +85,7 @@ jobs:
           exit-code: "0"
 
       - name: Upload Trivy results
-        if: always()
+        if: always() && vars.ENABLE_CODE_SCANNING == 'true'
         uses: github/codeql-action/upload-sarif@v4
         with:
           sarif_file: trivy-${{ matrix.app }}.sarif