docs: expand proactive SCA section — Trivy prerequisite and setup paths

[claudiacodacy]

Summary

• Replaces the single-line Trivy note in the SCA findings section with a full explanation of how proactive SCA nightly scans work
• Makes Trivy an explicit hard prerequisite (tool + vulnerability patterns — both required)
• Documents both setup paths: via coding standard (recommended) and per-repo
• Adds a clear silent-failure warning: enabling the tool alone is not sufficient; missing patterns → scans run but produce nothing, Dependency Explorer shows no data
• Adds a new H4 subsection with anchor #proactive-sca-requirements so Phase 2 in-product CTAs (OD-143, OD-144) can deep-link directly to the prerequisite content

Context

Part of the Enable Trivy when enabling proactive SCA project. This is the Phase 1 prerequisite — every in-product CTA planned for Phase 2 links here.

Linear: OD-139 | Jira: ODIN-106
Analysis doc: Proactive SCA & Trivy Enablement — Problem Analysis & Options

Test plan

• Verify #proactive-sca-requirements anchor resolves correctly on the rendered page
• Verify #dependencies-list and #item-list anchor links work within the page
• Verify relative links to using-coding-standards.md and ../repositories-configure/configuring-code-patterns.md resolve
• Verify the Knock link (start-chat.com/slack/codacy/rmbTzb) opens the chat correctly

🤖 Generated with Claude Code

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[gemini-code-assist]

Code Review

This pull request updates the documentation regarding how Codacy manages findings detected during Software Composition Analysis (SCA). It clarifies the behavior of proactive SCA nightly scans, outlines the specific Trivy requirements needed for these scans to run successfully, and provides instructions on enabling Trivy either via coding standards or per repository. The feedback suggests a minor grammatical improvement to hyphenate 'Business-tier' when used as a compound modifier.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[github-actions]

Overall readability score: 54.23 (🟢 +0)

File	Readability
managing-security-and-risk.md	58.71 (🟢 +0.68)

View detailed metrics

🟢 - Shows an increase in readability
🔴 - Shows a decrease in readability

File	Readability	FRE	GF	ARI	CLI	DCRS
managing-security-and-risk.md	58.71	36.89	9.72	12.8	12.82	6.45
	🟢 +0.68	🟢 +0.3	🟢 +0.19	🟢 +0.1	🟢 +0	🟢 +0.05

Averages:

	Readability	FRE	GF	ARI	CLI	DCRS
Average	54.23	43.17	10.9	12.3	12.24	8.01
	🟢 +0	🟢 +0	🟢 +0	🟢 +0	🟢 +0	🟢 +0

View metric targets

Metric	Range	Ideal score
Flesch Reading Ease	100 (very easy read) to 0 (extremely difficult read)	60
Gunning Fog	6 (very easy read) to 17 (extremely difficult read)	8 or less
Auto. Read. Index	6 (very easy read) to 14 (extremely difficult read)	8 or less
Coleman Liau Index	6 (very easy read) to 17 (extremely difficult read)	8 or less
Dale-Chall Readability	4.9 (very easy read) to 9.9 (extremely difficult read)	6.9 or less

[codacy-production]

Pull Request Overview

The documentation expansion for Proactive SCA accurately captures the mandatory Trivy prerequisites and setup paths, meeting Codacy quality standards. However, a significant discrepancy exists between the implementation and the technical requirements: the identifier for low-severity vulnerabilities is incorrectly documented as 'minor', which is not a valid pattern ID. Additionally, several internal and external links, along with the deep-linking anchor, require manual verification to ensure navigational integrity. These issues should be addressed to prevent configuration failures for users following these instructions.

Test suggestions

• Verify the '#proactive-sca-requirements' anchor is present and correctly formatted for deep-linking.\n- [ ] Verify relative links to 'using-coding-standards.md' and repository code patterns documentation resolve correctly.\n- [ ] Verify internal page links to '#dependencies-list' and '#item-list' resolve to valid sections within the same document.\n- [ ] Verify the external support chat link is valid and points to the correct destination.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify the '#proactive-sca-requirements' anchor is present and correctly formatted for deep-linking.\n- [ ] Verify relative links to 'using-coding-standards.md' and repository code patterns documentation resolve correctly.\n- [ ] Verify internal page links to '#dependencies-list' and '#item-list' resolve to valid sections within the same document.\n- [ ] Verify the external support chat link is valid and points to the correct destination.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}