Fix orphaned tags and empty tables in PR comments

[lelia]

Summary

Security comments posted on pull requests could render orphaned </blockquote></details> tags as a literal code block, and could leave the "Caution" banner sitting above an alerts table with no rows.

A whitespace-only line closes a CommonMark HTML block. Optional sections that rendered as empty left one behind inside the alerts table, and because the closing tags after it are indented four or more spaces they were rendered as an indented code block rather than markup. The empty table appeared separately, when a comment's alerts were all resolved by a later commit or ignored by comment.

Changes

• Generated comment markup no longer contains blank lines and stays under the indentation that starts a code block.
• Alert descriptions, suggestions and license findings are collapsed onto a single line, so multi-line API text cannot break the table either.
• When no alerts are left to report, the comment body is replaced with a short confirmation instead of an empty table. The comment marker is preserved, so a commit that reintroduces an alert updates the same comment rather than posting a second one.
• @SocketSecurity ignore-all now applies to comments in the pre-2.0.55 Markdown table format. The check was made once per ignore command, and an ignore-all comment produces none, so no rows were removed.

Bumps to 2.6.8.

Testing

• tests/unit/test_pr_comment_rendering.py covers both artifacts, the ignore round trips, and the collapsed body.
• Every generated body was rendered through GitHub's /markdown API to confirm the tags are gone; 417 unit and 87 core tests pass.

Fixes CE-381

---

Note

Low Risk
Changes are limited to PR comment string generation and ignore reprocessing; no scan, auth, or API behavior changes. Risk is mainly cosmetic/regression in SCM comment display.

Overview
Fixes CE-381 by hardening how Socket security PR comments are generated and rewritten so GitHub/GitLab CommonMark renderers do not break the alerts table or leave a misleading Caution banner with no rows.

Comment markup now drops whitespace-only lines and caps indentation below four spaces (via normalize_comment_html), and flattens multi-line alert titles, descriptions, suggestions, and license findings (inline_html_text) so embedded newlines cannot close the HTML block early—addressing the literal </blockquote></details> code-block artifact when ignore instructions were empty (--disable-ignore).

When every alert is resolved on a later scan or removed via ignore comments, the body switches to a short no alerts confirmation while keeping <!-- socket-security-comment-actions --> and the report link, so the same comment is updated instead of posting a second one.

Ignore handling fixes @SocketSecurity ignore-all for legacy Markdown table comments (pre-2.0.55) by evaluating ignore_all outside the per-command loop, and applies the same collapse + HTML normalization when processing updated HTML-table comments.

Release 2.6.8 with regression tests in tests/unit/test_pr_comment_rendering.py.

^{Reviewed by Cursor Bugbot for commit c4f5c80. Configure here.}

[Eric Hibbs (flowstate)]

LGTM!

oh and we should add a lint:fix via ruff somewhere in our automation, main is carrying around like 75 formatting issues, nothing major