chore: explain why code/snyk GitHub App check persists despite workflow disable

[Copilot]

The code/snyk (mightyprytanis) check continues to appear on PRs even though snyk-security.yml is disabled. This is because Snyk (and Semgrep) each have a GitHub App integration that triggers PR checks independently of any workflow file — disabling the workflow has no effect on the App.

Status of each check

Check	Source	Status
snyk-security.yml	GitHub Actions workflow	✅ Disabled (workflow_dispatch only + if: ${{ false }})
codeql.yml	GitHub Actions workflow	✅ PR trigger removed
semgrep.yml	GitHub Actions workflow	✅ PR trigger removed
SnykCode / code/snyk (mightyprytanis)	Snyk GitHub App	⚠️ Still running — must be disabled externally
semgrep-cloud-platform/scan	Semgrep GitHub App	⚠️ Still running — must be disabled externally

Required action (cannot be done via code)

To stop code/snyk from running on PRs, one of:

• Snyk dashboard → Settings → GitHub integration → disable PR checks or disconnect the repo
• GitHub → Settings → GitHub Apps → Snyk → Configure → remove this repository from its access list

Same applies to semgrep-cloud-platform/scan if that check also needs to stop blocking auto-merges.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

Copilot wasn't able to review any files in this pull request.

[MightyPrytanis]

@copilot I have manually disabled Snyk code, yet it is still showing up. Why?

[Copilot]

@copilot I have manually disabled Snyk code, yet it is still showing up. Why?

Two things to clarify here:

1. SnykCode is NOT blocking this PR — it's showing as ✅ success (and completes in ~1 second, so it's effectively a no-op). Disabling "Snyk Code" in Snyk's dashboard turns off the scan itself but the GitHub App still posts a pass-through check run. To make it disappear entirely, you'd need to uninstall/revoke the Snyk GitHub App from this repo in GitHub Settings → Apps.

2. The actual blocker is Quality Gates — it's failing because Cyrano's test suite ran at 81.16% pass rate (56/69 tests passing, 13 failing), which is below the 85% threshold in ci.yml. This is a pre-existing Cyrano test failure unrelated to the Vite bump in this PR.

The auto-approve/auto-merge steps also showed as skipped because Vite 7→8 is a major version update, which the Dependabot auto-merge workflow intentionally excludes (it only auto-merges patch and minor updates).