Add Docker Scout security scanning to CI workflow

.github/workflows/code-quality.yml

@@ -12,19 +12,71 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - name: Checkout
+      - name: Checkout code
         uses: actions/checkout@v4
-      - name: Lint
+      - name: Run linting
         run: echo "Linting..."
 
   sonarqube:
     name: SonarQube
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout code
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
-      - name: SonarQube Scan
+      - name: Run SonarQube scan
         uses: SonarSource/sonarqube-scan-action@v5
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+
+  hadolint:
+    name: Dockerfile Linting
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Lint Dockerfile.n8n
+        run: docker run --rm -i hadolint/hadolint < Dockerfile.n8n
+      - name: Lint Dockerfile.temporal
+        run: docker run --rm -i hadolint/hadolint < Dockerfile.temporal
+
+  docker-scout:
+    name: Docker Security Scanning
+    runs-on: ubuntu-latest
+    needs: hadolint
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Build n8n image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: Dockerfile.n8n
+          push: false
+          tags: n8n-test:latest
+          load: true
+      - name: Build temporal image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: Dockerfile.temporal
+          push: false
+          tags: temporal-test:latest
+          load: true
+      - name: Scan n8n image
+        run: docker scout cves n8n-test:latest --format sarif --output n8n-scan.sarif
+      - name: Scan temporal image
+        run: docker scout cves temporal-test:latest --format sarif --output temporal-scan.sarif
+      - name: Upload n8n scan results
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: n8n-scan.sarif
+          category: n8n
+      - name: Upload temporal scan results
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: temporal-scan.sarif
+          category: temporal

.gitignore

@@ -134,3 +134,4 @@ dist
 .yarn/build-state.yml
 .yarn/install-state.gz
 .pnp.*
+volumes

Dockerfile.n8n

@@ -0,0 +1,15 @@
+FROM n8nio/n8n:1.22.0
+
+# Add custom environment variables
+ENV N8N_PORT=5678 \
+    NODE_ENV=production
+
+# Create app directory
+WORKDIR /home/node/.n8n
+
+# Add custom healthcheck
+HEALTHCHECK --interval=30s --timeout=10s --retries=3 \
+  CMD wget -q --spider http://localhost:${N8N_PORT}/healthz || exit 1
+
+# The entrypoint script is already defined in the base image
+# Don't override the CMD 

Dockerfile.temporal

@@ -0,0 +1,20 @@
+FROM temporalio/auto-setup:1.20
+
+# Set up environment variables for PostgreSQL and Elasticsearch
+ENV DB=postgresql \
+    DB_PORT=5432 \
+    POSTGRES_USER=temporal \
+    POSTGRES_PWD=temporal \
+    POSTGRES_SEEDS=postgresql \
+    ENABLE_ES=true \
+    ES_SEEDS=elasticsearch \
+    ES_VERSION=v7
+
+# Add custom healthcheck
+HEALTHCHECK --interval=30s --timeout=10s --retries=3 \
+  CMD temporal operator cluster health | grep -q SERVING || exit 1
+
+# Expose the gRPC port
+EXPOSE 7233
+
+# The entrypoint script is already defined in the base image 

README.md

@@ -1 +1,116 @@
-# automatization
+# n8n and Temporal Docker Compose Setup
+
+This repository contains a Docker Compose configuration to run n8n and Temporal services together.
+
+## Services
+
+The setup includes:
+
+- **n8n**: An automation tool that allows you to create workflows visually
+- **Temporal**: A workflow orchestration platform with the following components:
+  - Temporal server
+  - Temporal UI
+  - PostgreSQL (database)
+  - Elasticsearch (for visibility features)
+
+## Custom Docker Images
+
+This project uses custom Docker images built from the following Dockerfiles:
+
+- **Dockerfile.n8n**: Extends the official n8n image with custom configurations
+- **Dockerfile.temporal**: Extends the official Temporal auto-setup image
+
+## Usage
+
+### Starting the services
+
+```bash
+docker compose up -d
+```
+
+This will start all services in detached mode.
+
+### Building custom images
+
+If you've made changes to the Dockerfiles, you'll need to rebuild the images:
+
+```bash
+docker compose build
+```
+
+Or to rebuild and start in one command:
+
+```bash
+docker compose down && docker compose build && docker compose up -d
+```
+
+### Verifying services are running
+
+Check that all containers are running:
+
+```bash
+docker compose ps
+```
+
+You should see containers for:
+- n8n
+- temporal
+- temporal-ui
+- temporal-postgresql
+- temporal-elasticsearch
+
+### Accessing the services
+
+- **n8n**: http://localhost:5678
+- **Temporal UI**: http://localhost:8080
+
+You can verify the services are responding with:
+
+```bash
+# Check n8n is responding
+curl -I http://localhost:5678
+
+# Check Temporal UI is responding
+curl -I http://localhost:8080
+```
+
+### Stopping the services
+
+```bash
+docker compose down
+```
+
+To completely remove all data volumes:
+
+```bash
+docker compose down -v
+```
+
+## Data Persistence
+
+All data is stored in local volumes under the `./volumes/` directory:
+
+- `./volumes/n8n_data` - n8n data and workflows
+- `./volumes/elasticsearch-data` - Elasticsearch data for Temporal
+- `./volumes/postgresql-data` - PostgreSQL database for Temporal
+
+## Service Ports
+
+- n8n: 5678
+- Temporal server: 7233 (gRPC API, not HTTP)
+- Temporal UI: 8080
+- PostgreSQL: 5432
+- Elasticsearch: 9200
+
+## Troubleshooting
+
+If you encounter any issues:
+
+1. Check container logs:
+   ```bash
+   docker logs temporal
+   docker logs automatization-n8n-1
+   ```
+
+2. Ensure all required ports are available on your system
+3. Make sure Docker has sufficient resources allocated

docker-compose.yml

@@ -0,0 +1,99 @@
+services:
+  # n8n service
+  n8n:
+    build:
+      context: .
+      dockerfile: Dockerfile.n8n
+    ports:
+      - "5678:5678"
+    environment:
+      - WEBHOOK_URL=http://localhost:5678/
+    volumes:
+      - ./volumes/n8n_data:/home/node/.n8n
+    networks:
+      - app-network
+
+  # Temporal services
+  elasticsearch:
+    container_name: temporal-elasticsearch
+    image: opensearchproject/opensearch:2.5.0
+    environment:
+      - discovery.type=single-node
+      - bootstrap.memory_lock=true
+      - "OPENSEARCH_JAVA_OPTS=-Xms256m -Xmx256m"
+      - "DISABLE_SECURITY_PLUGIN=true"
+      - "DISABLE_INSTALL_DEMO_CONFIG=true"
+    ports:
+      - 9200:9200
+    ulimits:
+      memlock:
+        soft: -1
+        hard: -1
+    volumes:
+      - ./volumes/elasticsearch-data:/usr/share/opensearch/data
+    networks:
+      - app-network
+
+  postgresql:
+    container_name: temporal-postgresql
+    image: postgres:14
+    environment:
+      POSTGRES_USER: temporal
+      POSTGRES_PASSWORD: temporal
+      POSTGRES_DB: temporal
+    ports:
+      - 5432:5432
+    volumes:
+      - ./volumes/postgresql-data:/var/lib/postgresql/data
+    networks:
+      - app-network
+
+  temporal:
+    container_name: temporal
+    build:
+      context: .
+      dockerfile: Dockerfile.temporal
+    depends_on:
+      - postgresql
+      - elasticsearch
+    ports:
+      - 7233:7233
+    networks:
+      - app-network
+
+  temporal-ui:
+    container_name: temporal-ui
+    image: temporalio/ui:2.10.3
+    depends_on:
+      - temporal
+    environment:
+      - TEMPORAL_ADDRESS=temporal:7233
+      - TEMPORAL_PERMIT_WRITE_API=true
+    ports:
+      - 8080:8080
+    networks:
+      - app-network
+
+volumes:
+  n8n_data:
+    driver: local
+    driver_opts:
+      type: none
+      o: bind
+      device: ${PWD}/volumes/n8n_data
+  elasticsearch-data:
+    driver: local
+    driver_opts:
+      type: none
+      o: bind
+      device: ${PWD}/volumes/elasticsearch-data
+  postgresql-data:
+    driver: local
+    driver_opts:
+      type: none
+      o: bind
+      device: ${PWD}/volumes/postgresql-data
+
+networks:
+  app-network:
+    driver: bridge