Hi, thanks for taking the time to fix this! I wanted to say that it's not incorrect that every PR needs to have an Issue. We still use Issues to track work items. The fix needs to clarify that users aren't expected to create issues directly but to start a discussion which will perhaps result in an issue. could you update your PR please?

I updated the PR. It seems hard to expect PR submitters to first wait for an issue.

sorry for nitpicking but it makes it sound like discussions and issues are interchangable. If they were, we wouldn't have used both. For clarification (not needed in the dec), the discussion is just what it says - a conversation, and the Issue is a confirmed work item. A PR should have an Issue linked, unless it's a trivial change, this is aleady written. Allowing to linking a discussion in PR means there was already a discussion but it wasn't converted into an issue, so it's either not accepted, or too trivial for an Issue, in which case there's no need to link anything. Of course IRL people can link discussions or paste excepts or link to external resources in PRs, or anything that supports the PR description, but as far as the guidelines I would stick with link to Issue (ideally) or nothing.

Is this clear enough?

Every Pull Request should have an associated GitHub Issue. Note that issues are created by Trivy mainatiners based on feedback provided in a GitHub Discussion. Please refer to the Issue and discussion pages for explanation about this process.
If you think your change is trivial enough, you can skip the issue and instead add justification and explanation in the PR description.