Security (OSS-CLI) #238

Job	Run time
Semgrep (SAST)	25s
Trivy (filesystem + container scan)	18s
Gitleaks (secret scan)	14s
jscpd (duplication < 3% on touched code)	16s
SBOM (SPDX + CycloneDX)	17s
OSV-Scanner (SCA)	52s
	2m 22s

Provide feedback