ci: scan the public gateway image without Docker Hub credentials

[ndbroadbent]

The docspringcom/rack-gateway image repository is public now, so the nightly Security Scan can pull the image without logging in. This PR removes the Docker Hub login from the image-scan job.

That token can push images. After this change, only the Release workflow uses it.

I confirmed that an anonymous registry token can fetch the v0.1.11 manifest.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 1 billable file and costs up to $0.25.}

• Ask an admin to make reviews automatic

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Or wait 52 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 61 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 160f4309-3c3b-4321-b91b-a05af701e9ce

📥 Commits

Reviewing files that changed from the base of the PR and between e814bd8 and 6129ab7.

📒 Files selected for processing (1)

• .github/workflows/security-scan.yml

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[deepsource-io]

DeepSource Code Review

We reviewed changes in e814bd8...6129ab7 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
JavaScript		Oct 13, 2026 3:34a.m.	Review ↗
Go		Oct 13, 2026 3:34a.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.