fix: reject --include-repos/--exclude-repos with --repo in github scan (#5112)

Explicit --repo entries bypass org-scan filtering entirely, so combining with --include-repos/--exclude-repos silently ignored patterns instead of erroring.
Add validation + doc comments explaining the bypass.

main.go

@@ -882,6 +882,13 @@ func runSingleScan(ctx context.Context, cmd string, cfg engine.Config) (metrics,
 		if len(*githubScanOrgs) > 0 && len(*githubScanRepos) > 0 {
 			return scanMetrics, fmt.Errorf("invalid config: you cannot specify both organizations and repositories at the same time")
 		}
+		// --include-repos/--exclude-repos only filter repos enumerated from an org/user scan;
+		// explicit --repo entries bypass that filtering step entirely (see enumerate() in
+		// pkg/sources/github/github.go), so combining them with --repo would silently no-op
+		// the filters instead of erroring.
+		if len(*githubScanRepos) > 0 && (len(*githubIncludeRepos) > 0 || len(*githubExcludeRepos) > 0) {
+			return scanMetrics, fmt.Errorf("invalid config: --include-repos and --exclude-repos only apply to organization or user scans and cannot be used with --repo")
+		}
 
 		if err := validateClonePath(*githubClonePath, *githubNoCleanup); err != nil {
 			return scanMetrics, err

pkg/sources/sources.go

@@ -309,9 +309,13 @@ type GithubConfig struct {
 	Repos []string
 	// Orgs is the list of organizations to scan.
 	Orgs []string
-	// ExcludeRepos is a list of repositories to exclude from the scan.
+	// ExcludeRepos is a list of repositories to exclude from an org/user scan.
+	// It only filters repos enumerated via Orgs; it has no effect when Repos is set
+	// explicitly, since explicit repos bypass the filtering step entirely.
 	ExcludeRepos []string
-	// IncludeRepos is a list of repositories to include in the scan.
+	// IncludeRepos is a list of repositories to include in an org/user scan.
+	// It only filters repos enumerated via Orgs; it has no effect when Repos is set
+	// explicitly, since explicit repos bypass the filtering step entirely.
 	IncludeRepos []string
 	// Filter is the filter to use to scan the source.
 	Filter *common.Filter