feat(ci): add container security scanning workflow

[williaby]

Adds Trivy + Hadolint container security scanning. This repo has a Dockerfile and was identified as missing this workflow during the Docker repo inventory audit.

[coderabbitai]

Warning

Review limit reached

Next included review available in 27 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 5 included reviews currently available. Your 10 included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Essentials

Run ID: 84f55706-dc67-44b3-8e02-223345c2abf9

📥 Commits

Reviewing files that changed from the base of the PR and between ca3bfe5 and 7863cc6.

📒 Files selected for processing (1)

• .github/workflows/container-security.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/add-container-security

---

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

🟡 Changes recommended

The new workflow references an external reusable workflow via a floating ref/owner mismatch and includes misleading/overbroad SARIF-related permissions/settings that should be corrected before merging.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds a new GitHub Actions workflow intended to run container-focused security checks (Trivy vulnerability scanning + Hadolint Dockerfile linting) by delegating to an org-level reusable workflow.

Changes:

• Introduces .github/workflows/container-security.yml to run container security scanning on Docker-related changes and on a weekly schedule.
• Configures concurrency, permissions, and reusable-workflow inputs for image build + scan and linting.

File summaries

File	Description
.github/workflows/container-security.yml	Adds a workflow that delegates container security scanning to a reusable workflow with configured triggers, permissions, and inputs.

Review details

Suppressed comments (1)

.github/workflows/container-security.yml:51

• upload-sarif is deprecated/no-op in the referenced reusable workflow; leaving it enabled here is misleading because it suggests results will be ingested into the Security tab. Consider not passing this input to avoid confusion.

      generate-sbom: true
      upload-sarif: true

• Files reviewed: 1/1 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.