Add Docker Scout security scanning to CI workflow

.github/workflows/code-quality.yml

@@ -40,6 +40,53 @@ jobs:
         run: docker run --rm -i hadolint/hadolint < Dockerfile.n8n
       - name: Lint Dockerfile.temporal
         run: docker run --rm -i hadolint/hadolint < Dockerfile.temporal
+
+  docker-scout:
+    name: Docker Security Scanning
+    runs-on: ubuntu-latest
+    needs: hadolint
+    strategy:
+      matrix:
+        service:
+          - name: n8n
+            dockerfile: Dockerfile.n8n
+            tag: n8n-test:latest
+          - name: temporal
+            dockerfile: Dockerfile.temporal
+            tag: temporal-test:latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Build ${{ matrix.service.name }} image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: ${{ matrix.service.dockerfile }}
+          push: false
+          tags: ${{ matrix.service.tag }}
+          load: true
+      - name: Scan ${{ matrix.service.name }} image
+        uses: docker/scout-action@v1
+        with:
+          command: cves
+          image: ${{ matrix.service.tag }}
+          sarif-file: ${{ matrix.service.name }}-scan.sarif
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          summary: true
+          format: json
+          write-comment: true
+      - name: Upload ${{ matrix.service.name }} scan results
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: ${{ matrix.service.name }}-scan.sarif
+          category: ${{ matrix.service.name }}
 
   service-check:
     name: Service Availability Check

.gitignore

@@ -12,6 +12,9 @@ mcp
 mcp-config.json
 .cursor/
 
+# JetBrains IDE
+.idea/
+
 # Diagnostic reports (https://nodejs.org/api/report.html)
 report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
 
@@ -140,3 +143,6 @@ dist
 .yarn/install-state.gz
 .pnp.*
 volumes
+
+n8n-scan.sarif
+temporal-scan.sarif