Security (OSS-CLI) #230

Job	Run time
Semgrep (SAST)	21s
Gitleaks (secret scan)	12s
Trivy (filesystem + container scan)	22s
OSV-Scanner (SCA)	50s
SBOM (SPDX + CycloneDX)	17s
jscpd (duplication < 3% on touched code)	18s
	2m 20s

Provide feedback