feat: add pr_comment_enabled and pr_comment_collapse_all PR comment controls

[John-David Dalton (jdalton)]

Teams can now turn the Socket Basics pull request comment off, or collapse every findings section, without giving up scanning. Findings still reach the Socket dashboard either way. This unblocks teams who want to evaluate finding quality in the dashboard first, without a comment landing on every developer's pull request.

Before this change the comment could not be turned off at all. There was a setting to auto-collapse non-critical findings, but critical findings always stayed expanded, so a single critical finding forced the whole comment open on every push.

What you get

Input	Default	What it does
pr_comment_enabled	true	Set to false and no comment is posted or updated.
pr_comment_collapse_all	false	Set to true and the collapsible findings sections start collapsed.

Nothing changes until a workflow opts in. Both switches default to today's behavior, so existing users see no difference when this merges.

Why turning off the comment cannot turn off the dashboard - the upload happens before any notifier runs

main() in socket_basics/socket_basics.py runs in a fixed order: scanners execute, results are written to .socket.facts.json, the facts are uploaded to the Socket dashboard, and only then do the notifiers run.

Because the comment is a notifier, it is the last step. Suppressing it cannot reach backward and suppress the upload that already happened. That ordering is what makes pr_comment_enabled: false safe to recommend: you lose the comment, never the data.

What collapse-all actually collapses - the SAST and Tier 1 sections, not every formatter

pr_comment_collapse_all is read by the OpenGrep and Tier 1 formatters only. The other outputs are unaffected, for two different reasons:

Output	Effect	Why
OpenGrep (SAST)	Collapses	Reads the flag. One summary row per file stays visible.
Socket Tier 1	Collapses	Reads the flag.
TruffleHog	No change	Renders a flat table with nothing to collapse.
Trivy Dockerfile	No change	Renders a flat table with nothing to collapse.
Trivy image and CVE	No change	Already always collapsed, and never reads the flag.

An earlier draft of this description claimed the comment becomes a single line. That was wrong in three separate ways, and the wording in action.yml, the docs, and the README now describes the real behavior. TestCollapseAllScope asserts byte-identical output with the flag on and off for the formatters above, so the narrowed contract cannot drift back without a test going red.

One fix that came out of review - CLI flags were parsed but never reached the config

add_dynamic_cli_args() registers CLI options from notifications.yaml, but create_config_from_args() only copied values defined in connectors.yaml. Parsing --pr-comment-collapse-all produced True while the effective config stayed False.

Both YAML files describe their parameters in the same shape, so one shared _apply_param_cli_overrides() now serves both, which also replaced three inlined copies of the same YAML read.

The subtle part is that every bool option now parses to None when absent rather than False. Otherwise "the user said nothing" and "the user said false" are the same value, and copying CLI values would clobber environment, JSON, and dashboard config.

Flags that default to true also gained negative forms through argparse.BooleanOptionalAction, so --no-pr-comment and friends exist. This was applied to every default-true bool parameter rather than just pr_comment_enabled, since they all shared the same defect. No connector flag defaults to true, so connector behavior is unchanged.

Testing

264 tests pass. Twelve are new: six covering the parser-to-config path and the negative flag forms, and six pinning which formatters collapse-all leaves alone.

Like every change to this action, it reaches users at the next release tag.

---

Note

Medium Risk
Changes PR comment posting and shared config/CLI merging for all notifier bool flags; defaults preserve current behavior, but mis-parsed flags or suppression could surprise teams expecting comments or label behavior.

Overview
Adds pr_comment_enabled (default on) so workflows can run scans and Socket dashboard upload without posting or updating the PR findings comment; job failure on high/critical and other notifiers still run, and pr_labels_enabled stays separate.

Adds pr_comment_collapse_all so OpenGrep SAST and Socket Tier 1 <details> sections start collapsed even when critical; it overrides pr_comment_collapse_non_critical. TruffleHog and Dockerfile Trivy output (flat tables) is unchanged.

Introduces shared coerce_bool for PR comment flags and env loading so string "false"/"true", dashboard strings, and blank or unset INPUT_* values resolve consistently (empty → documented default, not silent off).

Config/CLI: notifier parameters from notifications.yaml are applied via the same _apply_param_cli_overrides path as connectors (fixes parsed flags like --pr-comment-collapse-all never reaching effective config); default-true bools get --no-* forms; absent CLI options leave env/JSON/dashboard values in place.

action.yml, notifications.yaml, README, and PR comment docs updated; preview script and tests cover suppression, collapse scope, coercion, and CLI wiring.

^{Reviewed by Cursor Bugbot for commit ab96ff8. Configure here.}

[John-David Dalton (jdalton)]

bugbot run

[John-David Dalton (jdalton)]

bugbot run

[lelia]

The separation between comment suppression, labels, and the scan/upload path looks good. I found two user-facing gaps that should be resolved before merge: the newly exposed CLI switches are not applied to the effective config, and the documented collapse-all contract is broader than the formatter behavior. Details are inline; the action/env/dashboard behavior and test coverage otherwise look solid.

[lelia]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit ab96ff8. Configure here.}

[lelia]

thanks for submitting this John-David Dalton (@jdalton) ! i pushed a small docs fix to update to the proper Socket Basics version ref FYI.