- Added Checkov security scan job that runs before SonarQube - Configured for Terraform-specific IaC compliance checks - Outputs results in CLI and SARIF formats - Uploads scan results as artifacts for review - SonarQube job now depends on Checkov passing - Renamed workflow to reflect both quality and security scanning