DiffScope Review: use docker run instead of uses docker:// to avoid pre-pull failing job

GitHub pre-pulls container actions before any steps run; that pull was failing the job.
Run DiffScope via 'docker run' only when image is already available from Check image step.

Made-with: Cursor

Author: haasonsaas

.github/workflows/diffscope.yml

@@ -48,12 +48,12 @@ jobs:
 
       - name: Run DiffScope
         if: steps.check_key.outputs.skip != 'true' && steps.check_image.outputs.available == 'true'
-        uses: docker://ghcr.io/evalops/diffscope:latest
-        continue-on-error: true
-        env:
-          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
-        with:
-          args: review --diff pr.diff --output-format json --output comments.json
+        run: |
+          docker run --rm \
+            -e OPENAI_API_KEY="${{ secrets.OPENAI_API_KEY }}" \
+            -v "$PWD":/workspace -w /workspace \
+            ghcr.io/evalops/diffscope:latest \
+            review --diff pr.diff --output-format json --output comments.json
 
       - name: Post comments
         if: steps.check_key.outputs.skip != 'true' && steps.check_image.outputs.available == 'true'