feat: add pr_comment_enabled and pr_comment_collapse_all PR comment controls

README.md

@@ -104,11 +104,12 @@ Socket Basics can also run locally or in other CI/CD environments:
 Socket Basics delivers **beautifully formatted, actionable PR comments** with smart defaults — all enabled by default, zero configuration needed.
 
 - 🔗 **Clickable File Links** — Jump directly to the vulnerable code in GitHub
-- 📋 **Collapsible Sections** — Critical findings auto-expand, others collapse
+- 📋 **Collapsible Sections** — SAST and Socket Tier 1 findings collapse, critical ones auto-expand; `pr_comment_collapse_all: 'true'` closes those too
 - 🎨 **Syntax Highlighting** — Language-aware code blocks
 - 🏷️ **Auto-Labels** — PRs tagged with severity-based labels (e.g., `security: critical`)
 - 🔴 **CVE Links & CVSS Scores** — One-click access to NVD with risk context
 - 🚀 **Full Scan Link** — Report link prominently displayed at the top
+- 🔇 **Fully Suppressible** — `pr_comment_enabled: 'false'` stops the comment entirely while the scan still runs, still uploads to the Socket dashboard, and still fails the job on high/critical findings
 
 Every feature is customizable via GitHub Actions inputs, CLI flags, or environment variables.
 

action.yml

@@ -91,9 +91,11 @@ runs:
     INPUT_WEBHOOK_URL: ${{ inputs.webhook_url }}
     SOCKET_ADDITIONAL_PARAMS: ${{ inputs.socket_additional_params }}
     SOCKET_TIER_1_ENABLED: ${{ inputs.socket_tier_1_enabled }}
+    INPUT_PR_COMMENT_ENABLED: ${{ inputs.pr_comment_enabled }}
     INPUT_PR_COMMENT_LINKS_ENABLED: ${{ inputs.pr_comment_links_enabled }}
     INPUT_PR_COMMENT_COLLAPSE_ENABLED: ${{ inputs.pr_comment_collapse_enabled }}
     INPUT_PR_COMMENT_COLLAPSE_NON_CRITICAL: ${{ inputs.pr_comment_collapse_non_critical }}
+    INPUT_PR_COMMENT_COLLAPSE_ALL: ${{ inputs.pr_comment_collapse_all }}
     INPUT_PR_COMMENT_CODE_FENCING_ENABLED: ${{ inputs.pr_comment_code_fencing_enabled }}
     INPUT_PR_COMMENT_SHOW_RULE_NAMES: ${{ inputs.pr_comment_show_rule_names }}
     INPUT_PR_LABELS_ENABLED: ${{ inputs.pr_labels_enabled }}
@@ -442,6 +444,15 @@ inputs:
     description: "Generic webhook URL for WebhookNotifier"
     required: false
     default: ""
+  pr_comment_enabled:
+    description: >-
+      Post the findings comment on the pull request. Set to 'false' to run the
+      scan silently: findings are still uploaded to the Socket dashboard and the
+      action still fails the job on high/critical findings, but no comment is
+      posted or updated. Severity labels are controlled separately by
+      pr_labels_enabled.
+    required: false
+    default: "true"
   pr_comment_links_enabled:
     description: "Enable clickable file/line links in PR comments"
     required: false
@@ -454,6 +465,15 @@ inputs:
     description: "Auto-collapse non-critical findings (critical stays expanded)"
     required: false
     default: "true"
+  pr_comment_collapse_all:
+    description: >-
+      Collapse the SAST and Socket Tier 1 sections, critical findings included.
+      Those are the sections built from collapsible panels, so they are the
+      ones this can close. Secret findings and Dockerfile findings render as
+      plain tables and stay fully visible, and each collapsed section still
+      shows its summary row. Overrides pr_comment_collapse_non_critical.
+    required: false
+    default: "false"
   pr_comment_code_fencing_enabled:
     description: "Enable language-aware code fencing for trace output"
     required: false

docs/github-action.md

@@ -328,6 +328,8 @@ jobs:
 
 Socket Basics automatically posts enhanced PR comments with **smart defaults that work out of the box** — clickable file links, collapsible sections, syntax highlighting, CVE links, CVSS scores, and auto-labels are all enabled by default.
 
+To run the scan without commenting on the PR at all, set `pr_comment_enabled: 'false'`. The scan still runs, findings are still uploaded to the Socket dashboard, and the job still fails on high/critical findings — only the comment is suppressed. If you want a quieter comment rather than no comment, `pr_comment_collapse_all: 'true'` closes the SAST and Socket Tier 1 sections, critical findings included.
+
 📖 **[PR Comment Guide →](github-pr-comment-guide.md)** — Complete customization options, configuration examples, and reference table
 
 ## Enterprise Features

docs/github-pr-comment-guide.md

@@ -89,8 +89,24 @@ pr_comment_collapse_enabled: 'false'
 # Keep collapsible but expand everything
 pr_comment_collapse_enabled: 'true'
 pr_comment_collapse_non_critical: 'false'
+
+# Keep collapsible and collapse the SAST and Tier 1 sections, critical included
+pr_comment_collapse_enabled: 'true'
+pr_comment_collapse_all: 'true'
 ```
 
+> [!NOTE]
+> `pr_comment_collapse_non_critical` deliberately leaves critical findings
+> expanded, so a single critical finding always opens the comment. Set
+> `pr_comment_collapse_all: 'true'` to close those sections too. It overrides
+> `pr_comment_collapse_non_critical`.
+>
+> The flag reaches the sections that are built from collapsible panels, which
+> are the SAST findings and the Socket Tier 1 findings. Secret findings and
+> Dockerfile findings render as plain markdown tables, so they stay fully
+> visible either way, and every collapsed SAST section still shows one summary
+> row per file.
+
 ---
 
 ### 3. Syntax Highlighting (`pr_comment_code_fencing_enabled`)
@@ -290,7 +306,48 @@ The logo is a 32px PNG rendered at 24x24 for retina-crisp display, with a transp
 
 ---
 
-### 9. All-Clear Comment Updates
+### 9. Turning the Comment Off (`pr_comment_enabled`)
+
+**Default:** `true`
+
+Set `pr_comment_enabled: 'false'` to run the scan without saying anything on the
+PR. This is for teams who want to review finding quality in the Socket dashboard
+first, without every PR growing a comment that developers have to scroll past.
+
+```yaml
+- uses: SocketDev/socket-basics@v2
+  with:
+    socket_security_api_key: ${{ secrets.SOCKET_SECURITY_API_KEY }}
+    github_token: ${{ secrets.GITHUB_TOKEN }}
+    pr_comment_enabled: 'false'
+```
+
+**What still happens when the comment is off:**
+
+| Behavior | Still happens? |
+|----------|----------------|
+| Scanners run (SAST, secrets, containers) | ✅ Yes |
+| Findings uploaded to the Socket dashboard | ✅ Yes |
+| `.socket.facts.json` written | ✅ Yes |
+| Job fails on high/critical findings | ✅ Yes |
+| Other notifiers (Slack, Jira, webhook, ...) | ✅ Yes |
+| Severity labels added to the PR | ✅ Yes, unless `pr_labels_enabled: 'false'` |
+| Comment posted or updated | ❌ No |
+
+Notifiers are the very last thing the run does — the scan finishes and the
+findings are uploaded to Socket before any comment would be posted — so turning
+the comment off cannot turn the dashboard off. Labels are a separate switch
+(`pr_labels_enabled`) so you can keep or drop them independently.
+
+> [!TIP]
+> If you want to keep the comment but make it quieter, use
+> `pr_comment_collapse_all: 'true'` instead. That closes the SAST and Socket
+> Tier 1 sections, critical findings included, so those sections are down to a
+> summary row until someone opens them.
+
+---
+
+### 10. All-Clear Comment Updates
 
 When a later Socket Basics run no longer has active findings for a previously-reported scanner section, the existing PR comment section is updated in place instead of being left stale or deleted.
 
@@ -312,9 +369,11 @@ When a later Socket Basics run no longer has active findings for a previously-re
 
 | Option | Default | Type | Description |
 |--------|---------|------|-------------|
+| `pr_comment_enabled` | `true` | boolean | Post/update the findings comment on the PR |
 | `pr_comment_links_enabled` | `true` | boolean | Enable clickable file/line links |
 | `pr_comment_collapse_enabled` | `true` | boolean | Enable collapsible sections |
-| `pr_comment_collapse_non_critical` | `true` | boolean | Auto-collapse non-critical findings |
+| `pr_comment_collapse_non_critical` | `true` | boolean | Auto-collapse non-critical findings (critical stays expanded) |
+| `pr_comment_collapse_all` | `false` | boolean | Collapse the SAST and Socket Tier 1 sections, critical included |
 | `pr_comment_code_fencing_enabled` | `true` | boolean | Enable syntax highlighting |
 | `pr_comment_show_rule_names` | `true` | boolean | Show explicit rule names |
 | `pr_labels_enabled` | `true` | boolean | Add severity-based labels to PRs |
@@ -323,6 +382,18 @@ When a later Socket Basics run no longer has active findings for a previously-re
 | `pr_label_medium` | `"security: medium"` | string | Label name for medium findings |
 | `pr_label_low` | `"security: low"` | string | Label name for low findings |
 
+### How boolean options are read
+
+Every boolean above accepts `true`, `1`, `yes` and `on` for on, and `false`,
+`0`, `no` and `off` for off, in any capitalization, whether it arrives as a
+GitHub Action input, an environment variable, a `--config` JSON file, or a
+Socket dashboard config.
+
+A value that says nothing — blank, whitespace, or a word that is neither — falls
+back to the default in the table. This matters for `pr_comment_enabled`: passing
+it a workflow variable that turns out to be unset gives the action an empty
+string, and that leaves the comment on rather than silently switching it off.
+
 ### Configuration Methods
 
 **1. GitHub Actions (Recommended)**
@@ -394,6 +465,22 @@ pr_label_high: 'security'
 pr_label_medium: 'security'
 ```
 
+### Evaluation / Trial (Dashboard Only)
+
+Review findings in the Socket dashboard without putting anything on the PR:
+```yaml
+pr_comment_enabled: 'false'
+pr_labels_enabled: 'false'
+```
+
+### Quiet Comment (Collapsible Sections Closed)
+
+Keep the SAST and Socket Tier 1 sections closed even when there are critical
+findings:
+```yaml
+pr_comment_collapse_all: 'true'
+```
+
 ---
 
 ## 🚀 Migration Guide

scripts/preview_pr_comments.py

@@ -36,6 +36,7 @@ def make_mock_config(
     repo="SocketDev/example-app",
     commit="a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2",
     full_scan_url="https://socket.dev/dashboard/scan/12345",
+    collapse_all=False,
 ):
     """Build a mock config object matching the real pipeline shape."""
     return MockConfig(
@@ -44,6 +45,7 @@ def make_mock_config(
         pr_comment_links_enabled=True,
         pr_comment_collapse_enabled=True,
         pr_comment_collapse_non_critical=True,
+        pr_comment_collapse_all=collapse_all,
         pr_comment_code_fencing_enabled=True,
         pr_comment_show_rule_names=True,
         full_scan_html_url=full_scan_url,