Add Docker Scout security scanning to CI workflow

.github/workflows/code-quality.yml

@@ -40,6 +40,56 @@ jobs:
         run: docker run --rm -i hadolint/hadolint < Dockerfile.n8n
       - name: Lint Dockerfile.temporal
         run: docker run --rm -i hadolint/hadolint < Dockerfile.temporal
+
+  docker-scout:
+    name: Docker Security Scanning
+    runs-on: ubuntu-latest
+    needs: hadolint
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Build n8n image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: Dockerfile.n8n
+          push: false
+          tags: n8n-test:latest
+          load: true
+      - name: Build temporal image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: Dockerfile.temporal
+          push: false
+          tags: temporal-test:latest
+          load: true
+      - name: Scan n8n image
+        uses: docker/scout-action@v1
+        with:
+          command: cves
+          image: n8n-test:latest
+          sarif-file: n8n-scan.sarif
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Scan temporal image
+        uses: docker/scout-action@v1
+        with:
+          command: cves
+          image: temporal-test:latest
+          sarif-file: temporal-scan.sarif
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Upload n8n scan results
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: n8n-scan.sarif
+          category: n8n
+      - name: Upload temporal scan results
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: temporal-scan.sarif
+          category: temporal
 
   service-check:
     name: Service Availability Check

.gitignore

@@ -12,6 +12,9 @@ mcp
 mcp-config.json
 .cursor/
 
+# JetBrains IDE
+.idea/
+
 # Diagnostic reports (https://nodejs.org/api/report.html)
 report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
 
@@ -140,3 +143,6 @@ dist
 .yarn/install-state.gz
 .pnp.*
 volumes
+
+n8n-scan.sarif
+temporal-scan.sarif