docs(examples): describe automatic sample PR scans

[mldangelo-oai]

Summary

The sample setup instructions required manual approval for every inference run, preventing unattended PR scans. Document the automatic setup while retaining the protected-main workflow and environment-scoped API key.

Changes

• Configure the inference environment without required reviewers or a wait timer and retain its main-only deployment rule.
• Remove mandatory approval steps from the baseline instructions and explain how adding reviewers affects automatic scans.
• Preserve the documented source checks and fallback behavior for events GitHub suppresses.

Testing

• All 38 sample application and scan-orchestration Node tests passed.
• All 17 focused Invoice Desk and GitHub Actions example Bun tests passed.
• Installed the pinned CLI 0.1.30 with the workflow's installation options; dry-run, mock scan, SARIF export, and metrics extraction passed without inference.
• A live PR scan started without manual approval and passed installation, source extraction, and eligibility checks, but inference failed authentication. End-to-end scan completion remains unverified until a working environment API key is configured.
• git diff --check passed. Independent review found no actionable issues in the documentation change.

Risk and rollout

Documentation only; no CLI or workflow implementation changes. The environment's required-reviewer gate was removed separately, with its main-only deployment rule and secret storage retained. Automatic inference consumes API usage. The source recheck still skips closed or superseded revisions, and the existing GitHub event-suppression limitation still applies.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[alandelong-oai]

Reviewed the complete actual PR contribution and changed tests with three independent passes, followed by targeted synthesis. Static review only; product tests were not executed.

No supported introduced correctness or security finding remained in this contribution. Source approval does not establish CI, merge readiness, integration or deployment.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-05T19:25:10.702535Z	ed260b5	Draft marked ready
🔒 Security Review	✅ Completed 2026-10-05T19:27:34.820249Z	ed260b5	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ed260b55d8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Update the other guides to remove the approval requirement

With this approval-free setup, the repository's other entry points now contradict this promise: examples/README.md lines 27–29 still says scans use environment approval, and the linked examples/github-actions/README.md lines 98–105 says Invoice Desk scans run only after approval. A reader entering through either guide may configure required reviewers and unintentionally disable the unattended scanning described here, so those references should be updated in the same change.

Useful? React with 👍 / 👎.