[docs-scanner] Contradictory guidance on SBOM/provenance in GitHub Actions workflow

[docker-agent]

File: content/manuals/scout/integrations/ci/gha.md

Issue

The page contains contradictory guidance about SBOM and provenance attestations in the GitHub Actions workflow. The workflow code explicitly enables SBOM and provenance for non-PR builds:

sbom: ${{ github.event_name != 'pull_request' }}
provenance: ${{ github.event_name != 'pull_request' }}

But immediately after, a note states:

This comparison doesn't work if you push the image to a registry, or if you build an image that can't be loaded to the runner's local image store. For example, multi-platform images or images with SBOM or provenance attestation can't be loaded to the local image store.

Why this matters

A reader following this workflow will enable SBOM and provenance (as shown in the code), but then read that images with SBOM or provenance attestation "can't be loaded to the local image store." This creates confusion about whether the workflow will work as intended. The workflow shows one thing, the note warns against it.

Additionally, the note says "This comparison doesn't work if you push the image to a registry" but the workflow does push images on non-PR events (push: ${{ github.event_name != 'pull_request' }}), which further contradicts the guidance.

Suggested fix

Clarify the relationship between the workflow steps and the note. Either:

1. Explain that SBOM/provenance are only enabled for push events (not PRs) because the comparison step only runs on PRs where the image is loaded locally, OR
2. If the workflow is incorrect, update it to disable SBOM/provenance when local loading is required, OR
3. If the note is outdated (e.g., if Docker Scout can now handle these cases), update or remove the note

The workflow and the explanatory note should align rather than contradict each other.

---

Found by nightly documentation quality scanner